Individuals have the right to be forgotten and can request the erasure of personal data when:
- it is no longer necessary for the purpose you originally collected/ processed it for;
- the individual withdraws consent;
- you are relying on legitimate interests as your basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
- you are processing the personal data for direct marketing purposes and the individual objects to that processing;
- it was unlawfully processed (ie otherwise in breach of the GDPR); * it has to be erased in order to comply with a legal obligation; or
- it is processed for information society services to a child.
- Individuals can make a request for erasure verbally or in writing.
You can download a description of individuals’ rights under GDPR here
