Response to Data Subject Request: Right to Erasure
(GDPR Compliant, Able to Comply)

Summary

This template is a response to data subject request sets out a form of wording for use when responding to a request by a data subject to have their personal data erased under Article 17 of Assimilated Regulation (EU) 2016/679, UK GDPR, with which you are able to comply. This template contains practical guidance and drafting notes. If you are not able to comply with the request, see Response to Data Subject Request: Right to Erasure (GDPR Compliant, Able to Comply). Under Article 17 of the UK GDPR, data subjects are entitled to have their data erased (right to be forgotten) in certain circumstances. However, the right to erasure is not absolute. The right only applies win certain circumstances. This means you can refuse to comply with a request where no right to erasure exists. Even where the right applies, you may refuse to act on an erasure request: • Which is manifestly unfounded or excessive, in particular because of its repetitive character. You bear the burden of demonstrating the request is manifestly unfounded or excessive. See Article 12(5) of Assimilated Regulation (EU) 2016/679, UK GDPR. • If you can demonstrate that you are not in a position to identify the data subject (e.g., if you have deployed anonymisation measures). However, you should not refuse to accept additional information provided by the data subject to support the exercise of their rights. See Recital 57 and Article 12(2) of Assimilated Regulation (EU) 2016/679, UK GDPR –or– • Because an exemption applies—see, e.g., the exemptions in Article 17(3) of Assimilated Regulation (EU) 2016/679, UK GDPR, which includes exemptions for compliance with a legal obligation and for the establishment, exercise or defence of legal claims, and Schedule 2 of the Data Protection Act 2018, which includes a number of exemptions from the obligation to respond to data subject requests. In responding to the data subject's request, you will need to bear in mind the transparency requirements of the UK GDPR and ensure your response is easy to understand and explained in clear language. The right of erasure is part of a larger package of data subject rights, including: • Access • Rectification and restriction of processing rights • The right to data portability • A right to object to processing –and– • The right not to be subject to a decision based solely on automated processing, including profiling Other data subject rights could be impacted when dealing with an erasure request. This document reflects the UK GDPR regime. References and links to the GDPR refer to the UK GDPR (Assimiliated Regulation (EU) 2016/679) unless expressly stated otherwise.