Deletion request

Answer:

The right to be forgotten established under the EU GDPR is not an absolute right.

You must comply with a deletion request where:

- the individual has objected to the processing and (other than in relation to objections to direct marketing) there are - - no overriding legitimate grounds to justify that processing;
- the personal data is no longer needed for the purpose for which it was collected or processed;
- the individual withdraws consent and there are no other grounds for the processing;
- the personal data is unlawfully processed;
- there is a legal obligation under Union or Member State law to erase the personal data; or
- personal data was processed in connection with an online service offered to a child.

You do not need to comply if the processing is:

- necessary for rights of freedom of expression or information;
- for compliance with a legal obligation under Union or Member State law;
- in the public interest or carried out by an official authority;
- for public interest in the area of public health;
- for archiving or research; or
- for legal claims.