Skip to Content

GDPR - Notification Obligation Regarding Rectification or Erasure of Personal Data or Restriction of Processing - Data Rectification and Erasure Procedures

Recital - 66.
Right to be Forgotten
Executive Summary
If someone excercises their right to be forgotten, it is the controllers responsibility to communicate that to all controllers and processors they have shared the data with.
Recital Text
To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data. In doing so, that controller should take reasonable steps, taking into account available technology and the means available to the controller, including technical measures, to inform the controllers which are processing the personal data of the data subject's request.
Executive Summary
Policies and procedures should be created for ensuring the rectification or erasure of personal data when a data subject requests it. This includes informing and verifying any third parties who are processing or storing the data have completed the request. Once the request has been completed the data subject should be notified.