| | |

The Right to Erasure (Right to Be Forgotten)

ByPrivacyiQ

The GDPR gives individuals the right to be forgotten in certain cases. Understand what this means for your company.

Article 17 of the UK GDPR gives individuals the right to request the erasure of personal data where:

  • It’s no longer needed for its original purpose
  • The data subject withdraws consent
  • The data was unlawfully processed
  • They object to processing (and there are no overriding grounds)

However, this isn’t absolute. You may retain data if you need it for legal claims, compliance, or public interest.

💡 Tip:

Map your data retention policies now — so when a request comes in, you’ll know what can (and can’t) be deleted immediately.

Similar Posts

A professional woman in a classroom writing on a whiteboard during a lecture session.
| |

The Right to Rectification: Keeping Employee and Client Data Accurate

ByPrivacyiQ

Under GDPR Article 16, individuals have the right to correct inaccurate personal data. Learn how your company can stay compliant. Under Article 16 of the UK GDPR, individuals have the right to request the correction of inaccurate or incomplete personal data. Common requests include updates to: Companies must respond without undue delay, usually within one…

2 of 5: How to Handle Objections to Direct Marketing Under UK GDPR
|

2 of 5: How to Handle Objections to Direct Marketing Under UK GDPR

ByPrivacyiQ

Under Article 21 of UK GDPR, individuals can object to direct marketing at any time. Learn how your company must respond — and what compliance looks like in practice. Marketing teams rely on data to reach the right audience — but under Article 21 of the UK GDPR, individuals have an absolute right to object…

Bushfire in Australia
| |

Retention and Subject Access Requests: What You Don’t Keep Can’t Hurt You

ByPrivacyiQ

Subject access requests are easier (and cheaper) if you delete what you no longer need. Here’s why that’s strategic. Subject access requests (SARs) are rising — and they are expensive. But here’s the secret: the less data you hold, the less you have to search, redact, and disclose. Retention policies don’t just reduce legal risk….

A lively group of people gathers in an outdoor setting during daytime.
|

Are You Holding Employee Data Too Long? UK GDPR Says Think Again

ByPrivacyiQ

Professional services firms often retain employee data longer than necessary. Here’s what UK GDPR requires and how to mitigate risk. Employee data is a compliance blind spot for many professional services firms. From CVs and appraisal notes to disciplinary records, HR systems often store personal data far beyond its useful life — and well beyond…

Close-up of a professional video camera setup indoors, capturing high-quality footage.
|

Why Retaining Candidate Data Could Land You in Hot Water

ByPrivacyiQ

Storing CVs for years after rejection? It might be a data protection breach. Here’s what you need to know. It’s common for recruitment teams to keep CVs “just in case” — but under UK GDPR, this can be unlawful. The problem: If a candidate wasn’t hired, their data must only be retained if you have…

Article 13 vs Article 14 of the UK GDPR: What’s the Difference and Why It Matters
|

Article 13 vs Article 14 of the UK GDPR: What’s the Difference and Why It Matters

ByPrivacyiQ

Understand the key differences between Articles 13 and 14 of the UK GDPR, and why your company must tailor privacy notices depending on how personal data is collected. Companies often overlook the difference between Article 13 and Article 14 of the UK GDPR — yet getting this wrong can lead to non-compliance and ICO scrutiny….