Art.17 Right to erasure (right to be forgotten)
Erase personal data without undue delay where the data is no longer necessary for the purposes it was collected or processed for, where consent is withdrawn and no other legal ground applies, where the data subject objec
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Erasure records showing the ground relied on, the decision, and the date the data actually left each system · Data governance / DLP tooling
- A deletion capability map covering production, replicas, warehouses, logs, search indexes, backups and processors, with method and lag for each · Backup / DR tooling
periodic reviewEvidence produced at each review
- Evidence of the reasonable steps taken to inform other controllers where the data had been made public · Data governance / DLP tooling
governing documentDocuments that govern the control
- Where an exemption is applied, the specific Article 17(3) ground and the necessity reasoning for the data actually retained · Policy repository / GRC workspace
- Processor deletion confirmations obtained under the Article 28(3)(g) contract term · Vendor register / contract repository
First move
Start with the 2 of 5 artefacts that already live in a system (Data governance / DLP tooling); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Records flagged as deleted in the application while remaining fully readable in the database, the warehouse and the search index
- Backups excluded from erasure with no documented policy on the retention window and on not reinstating erased data at restore
- Legal claims cited as a blanket exemption across all data rather than for the data actually needed for an identified claim
- Erasure performed in house while processors and sub-processors holding the same data are never instructed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.16 Right to rectification · Art.18 Right to restriction of processing