The Right to Erasure (Right to Be Forgotten)
The GDPR gives individuals the right to be forgotten in certain cases. Understand what this means for your company.
-
-
Retention and Subject Access Requests: What You Don’t Keep Can’t Hurt You
Subject access requests are easier (and cheaper) if you delete what you no longer need. Here’s why that’s strategic. Subject access requests (SARs) are rising — and they are expensive. But here’s the secret: the less data you hold, the less you have to search, redact, and disclose. Retention policies don’t just reduce legal risk….
-
Annual Retention Reviews: A Quick Win for Compliance
A yearly review of your retention practices helps avoid silent failures. Here’s how to do one well. Retention rules are only as good as their enforcement. An annual review ensures your policies are followed — and still relevant. What to include in your yearly audit: Make it light-touch but regular. Small course corrections now prevent…
-
Breach Risk Increases With Ageing Data
The older the data, the more dangerous it becomes. Here’s why ageing data is a hidden security risk. Most cyber breaches don’t happen with fresh data — they happen with old, forgotten, poorly protected files. Why? Retention = risk control. Regularly deleting old personal data significantly reduces the impact of a breach — both legally…
-
Who Owns Data Retention in Your Organisation?
Is it IT? Legal? HR? Retention needs ownership — or it becomes a shared blind spot. Here’s how to assign responsibility. Without a clear owner, data retention becomes everyone’s responsibility — and no one’s priority. Ownership models that work: Either model can work — but only if: Assigning ownership turns policy into practice. Without it,…
-
What “No Longer Necessary” Really Means Under GDPR
The UK GDPR says don’t keep data longer than needed. But what does that actually mean in practice? UK GDPR Article 5 says personal data must be “kept no longer than is necessary.” But who defines necessary? Interpretation depends on: There’s no universal timeline — only justifiable ones. If your retention lacks clear purpose or…
-
Data Minimisation and Retention Go Hand in Hand
Minimising data doesn’t stop at collection — it includes timely deletion. Here’s how to tie the two together. Most teams know the data minimisation principle — collect only what you need. But it doesn’t stop there. Minimisation + Retention = Risk Reduction Retaining unnecessary data negates the benefit of collecting less in the first place….
-
Data Retention Risks: What Your ROPA Should Reflect
Your Record of Processing Activities (ROPA) should include clear retention rules. Here’s how to get it right. The Record of Processing Activities (ROPA) is a GDPR requirement — but many organisations miss a critical piece: retention periods. Why this matters: Tips for improvement: Think of ROPA as your data retention blueprint. If it’s vague, so…
-
Backups Aren’t Exempt From GDPR – Here’s Why That Matters
Think your backup server doesn’t count? Think again. GDPR applies to all personal data, including archives. Retention policies often focus on live systems, but forget one major risk: backups. Backups containing outdated or deleted personal data can still put you in breach of UK GDPR, especially if: What to do: GDPR applies whether data is…
-
Data Retention for Ex-Employees: A Hidden Risk
Are you keeping leavers’ data too long? Learn what the law says and how to reduce legal exposure. Many organisations store former employee data indefinitely — just in case. But UK GDPR doesn’t allow for “just in case” retention. Key retention timelines to know: After this period, data should be deleted or anonymised. Keeping more…
