One of the data subject's core rights is the right to erasure, the right to be forgotten. If a data subject asks to have their personal data erased, the starting point is that you must erase it. Exceptions may apply, often when the controller is a public authority or carries out a task in the public interest.

You may refuse erasure where continued processing of the data is necessary to protect other important rights, such as freedom of expression and information, to fulfil a legal obligation, or to establish, exercise, or defend legal claims. Whether you erase the data or have grounds to keep it, you must respond to the data subject without undue delay, within one month of the request. A GDPR software can help handle such requests within the statutory deadlines.