Forget Me: Handling Data Deletion Requests As A Data ...

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Complexity: Data can be scattered across various systems and backups (including cold or offsite backups). Your procedures should account for requirements surrounding comprehensive deletion. The CCPA, in particular, allows for data to persist in archived form “until the archived or backup system relating to that data is restored to an active system or is next accessed or used for a sale, disclosure, or commercial purpose.” 11 CCR § 7022(d). On the other hand, Article 17 of the GDPR does not have an exemption for backups, although DPAs have issued guidance that recognizes the need for sanity in this regard. “Certain data might need to be retained for legal reasons, such as sales records that must be retained for audit by taxing authorities.” Technical Limitations: Certain technologies might make complete deletion difficult. Ensure your processes address these limitations.

   In Data retention

2. Understanding Your Role “As a data processor, you may only act on instructions from the data controller.” When the user requests deletion from the controller, the controller will contact you to fulfill your part of that request. You are responsible for deleting the data you hold within a specified timeframe (usually a month under the GDPR or 45 days under statutes like the CCPA and TDSPA).

   In Outbound vendor data retention

3. Understanding Your Role “That is usually going to be your customer.” When the user requests deletion from the controller, the controller will contact you to fulfill your part of that request. You are responsible for deleting the data you hold within a specified timeframe (usually a month under the GDPR or 45 days under statutes like the CCPA and TDSPA).

   In Outbound vendor data retention

4. Understanding Your Role “Unless your contract specifies otherwise, data subjects requesting that a data processor delete data should be redirected to the data controller.” When the user requests deletion from the controller, the controller will contact you to fulfill your part of that request. You are responsible for deleting the data you hold within a specified timeframe (usually a month under the GDPR or 45 days under statutes like the CCPA and TDSPA).

   In Outbound vendor data retention

5. “This means they can request that companies delete their personal data.” Understanding Your Role

   In Prospect data deletion workflows

6. Fulfilling deletion requests isn’t always straightforward. Here are some things to keep in mind: “Your procedures should account for requirements surrounding comprehensive deletion.” Legal Obligations: Certain data might need to be retained for legal reasons, such as sales records that must be retained for audit by taxing authorities. Consult with the controller for guidance.

   In Prospect data deletion workflows

7. Verification: Authenticate the request to ensure it’s legitimate. You’ll likely rely on the controller for verification procedures. Specific verification requirements may be set out in your contract (such as who is authorized to transmit the request). “Providers with robust privacy programs will have much of this information in data inventories and flow maps.” Deletion: Permanently erase the identified data. Ensure no residual copies remain.

   In Outbound data vendors

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.