Fulfillment of the Right to Erasure of Personal Data, v1.0
Specifies requirements in accordance with General Data Protection Regulation (GDPR) Art. 17(1).
Assessment Step
|
1
Fulfillment of the Right to Erasure of Personal Data (FulfillmentoftheRighttoErasureofPersonalData)
When the data subject requests erasure, does the entity, without undue delay, erase the personal data concerning the data subject if: the data is no longer necessary for its original purpose; consent has been withdrawn with no other legal basis; the data subject objects and no overriding legitimate grounds exist; the data was processed unlawfully; the data must be erased to comply with a legal obligation; or the data was collected in relation to the offer of information society services to a child?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) and supporting notes as appropriate to support the assessor's response to this assessment step.
|
Conformance Criteria (1)
|
Fulfillment of the Right to Erasure of Personal Data
The data controller must, without undue delay, erase personal data concerning the data subject upon request, where one or more of the following conditions apply: the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; the data subject withdraws consent and there is no other legal ground for the processing; the data subject objects to the processing and there are no overriding legitimate grounds; the personal data has been unlawfully processed; the personal data must be erased to comply with a legal obligation; or the personal data has been collected in relation to the offer of information society services to a child.
Citation
GDPR
Art. 17(1), Recital 65, 66
|