The Right to Be Forgotten in Practice
The right to erasure — often called the 'right to be forgotten' — lets people ask you to delete their personal data in certain situations. It is not absolute, and knowing when it applies prevents both over- and under-reaction.
The points below are general guidance rather than legal advice.
When Erasure Applies
- The data is no longer needed for its original purpose.
- The person withdraws consent and there is no other basis.
- The data was processed unlawfully.
- There is a legal obligation to erase it.
When You Can Refuse
You may keep data where you must comply with a legal obligation, defend a legal claim, or where it is needed for freedom of expression. If you refuse, explain why and tell the person about their right to complain to the ICO.
Doing It Properly
- Confirm the requester's identity.
- Locate the data across all systems and backups.
- Delete or anonymise it where required.
- Tell any third parties you shared it with.
- Record what you did and why.
Frequently Asked Questions
What about backups?
Backups are tricky. A common approach is to flag the data for deletion and ensure it is not restored, removing it when backups naturally cycle.
If you need a hand with any of this, your Progressive Robot delivery team is ready to help. Raise a ticket from the Support area of your client portal or speak to your account manager and we will guide you through the next steps.