How to comply with data erasure requests with my emails

Feb 28, 2025

GDPR and CNIL: What is the right to erasure?

The right to erasure allows anyone to request an organization to delete their personal data. This right is a cornerstone of data protection in Europe and is based on clear rules established by the GDPR (General Data Protection Regulation). In France, the CNIL ensures the enforcement of this right and provides guidelines to help businesses comply. 💡 Data erasure and the right to be forgotten encompass the same concepts under the GDPR.

🌐 Recap: Complying with GDPR and CNIL for a Personal Data Erasure Request

📋 Key Steps🔑 Actions to Take
1. Receive and analyze the erasure request
  • Verify the validity of the request (data subject or legal representative) 📝
  • Identify the personal data concerned 🔍
2. Verify the requester’s identity
  • Request proof of identity (e.g., ID card, associated email) 🆔
  • Confirm that the request comes from the data subject 🔒
3. Analyze exceptions to the right to erasure
  • Check if legal exceptions apply, such as regulatory obligations 📜
  • Retain certain data if required 🗃️
4. Delete personal data
  • Delete the requested data unless a legal exception applies 🗑️
  • Check across all tools used (CRM, databases, etc.) 💻
  • Include subcontractors and service providers in the deletion process 🔄
5. Inform the data subject
  • Send a response email confirming data deletion 📧
  • Explain the reasons if deletion is not possible 🚫
6. Respect legal deadlines
  • Respond within one month ⏳
  • Possible extension of two months for complex requests ⚠️
7. Keep the request and response for proof
  • Retain a copy of the erasure request and the response as proof that the process was followed 📂
8. Possible sanctions for non-compliance
  • Prepare for CNIL fines of up to €20 million or 4% of annual global turnover 💸
9. Train and educate internal teams
  • Train teams on GDPR compliance and managing erasure requests 👩‍🏫
  • Raise awareness about exceptions and best practices 📚
10. Document internal procedures
  • Establish written procedures and document them 📑

Definition of the right to data deletion: What does the GDPR say?

The GDPR, in force since May 2018, defines the right to erasure in its Article 17. Here are the key points that marketing professionals and Data Protection Officers (DPOs) need to know:
  • Who can exercise this right? Any individual, provided the data in question is personal data.
  • When can erasure be requested? [visual]
    1. The data is no longer necessary for the original purpose.
    2. Consent has been withdrawn.
    3. The data was collected or processed unlawfully.
    4. The individual exercises their right to object, and there is no overriding legitimate reason to continue processing.
  • What types of data are concerned? All information that can directly or indirectly identify a person (name, email, IP address, etc.).
💡Note: The right to erasure is not absolute. Certain exceptions apply, such as compliance with a legal obligation or the defense of a legal claim.

France: What are the CNIL’s specifics regarding personal data deletion?

In France, the CNIL (Commission Nationale de l’Informatique et des Libertés) plays a key role in enforcing the right to erasure. Here’s what you need to know:
  • Role of the CNIL:
    • The CNIL supports businesses in achieving compliance.
    • It provides practical guides, response templates, and tools to facilitate request management.
  • How to process a request according to the CNIL?
    • Confirm receipt of the request within a reasonable timeframe.
    • Verify the identity of the individual to prevent abuse.
    • Execute the deletion of data within the legal timeframe of one month (extension possible if the request is complex).
  • Additional obligations:
    • Notify relevant subcontractors to ensure the data is also deleted from their systems.
    • Keep proof that the request was processed, without retaining the deleted data.
Example of situations where you should anticipate right-to-be-forgotten requests: A company collecting email addresses for a newsletter must delete a user’s email upon request and notify its email marketing partner to do the same.

What to do after a request for personal data deletion?

What types of data should be deleted?

When a data deletion request is received, you must identify all the relevant data:
  • Direct personal data:
    • Name, first name, email address, phone number, postal address.
  • Indirect data:
    • IP address, cookies, user IDs, behavioral data (such as purchase or browsing history).
  • Documents containing personal information:
    • Invoices, contracts, reports, attachments.
  • Copies and backups:
    • Check secondary databases, backups, or any tool that may store this data indirectly.

The data you hold: What should you delete?

Check the data you think should be deleted following a request:

Locate Data in Tools

To properly delete data, you need to know where it’s stored. Process to locate data for deletion:
  1. List the tools used:
    • CRM (e.g., Salesforce, HubSpot).
    • Emailing platforms.
    • Internal databases.
    • SaaS applications or ERP systems.
  2. Use built-in search tools: Most software allows you to search for a user via their email, ID, or name.
  3. Identify backups and archives: Some data may be stored in automatic archives. Plan a process to delete these as well.
  4. Don’t forget files outside of tools:
    • Excel or Google Sheets, sometimes used alongside primary tools.
Best practice: Centralize information in a processing register to simplify future data location. 🔗 Go beyond legal obligations: the value of implementing double opt-in

Don’t Forget to Notify Subcontractors and Service Providers of the Request

If your data is shared with partners, you must inform them of the erasure request:
  1. Identify your subcontractors:
    • Email service providers.
    • Cloud storage solutions.
    • Agencies or partners who had access to the data.
  2. Send them a notification:
    • Explain that an erasure request has been received.
    • Provide the necessary information to identify the relevant data.
  3. Ensure they take action:
    • Verify that the data has indeed been deleted.
    • Request written confirmation or a report proving the deletion.
💡 You remain responsible if a service provider fails to comply. Ensure that your contracts include GDPR compliance clauses. 🔗 Data collection, security… What are the other legal obligations for marketing teams?

The Role of the DPO in Data Erasure Requests

The Data Protection Officer (DPO) plays a central role in handling personal data erasure requests. Their mission is to ensure that the organization fully complies with GDPR requirements while protecting individuals’ rights.

The DPO’s Responsibilities:

  1. Be the primary point of contact: The DPO is often the direct recipient of erasure requests. They ensure that requests are properly documented and forwarded to the relevant teams.
  2. Verify the validity of the request: The DPO assesses whether the request meets GDPR legal conditions, including verifying the requester’s identity and evaluating potential exceptions.
  3. Oversee data location: They coordinate actions to identify data for deletion across all company systems and databases, including subcontractors.
  4. Ensure compliance and traceability: The DPO ensures each step of the erasure process is documented to guarantee compliance in case of an audit or dispute.
  5. Train and raise awareness: The DPO regularly trains internal teams to understand the implications of the right to erasure and the best practices to adopt.

A Strategic Role:

The DPO’s role goes beyond operations. They also act as an advisor to the organization, alerting about risks related to excessive data retention and ensuring technical measures, like automated deletion and updated retention policies, are implemented.

How to Validate a Data Erasure Request?

Verify the Identity of the Requester

Before proceeding with data erasure, ensure the identity of the person making the request. This step guarantees that only legitimate individuals can exercise this right.

What Documents to Request?

  • Proof of Identity: A copy of an ID (identity card, passport) may be required to confirm the requester’s identity.
  • Associated Email: Verify that the email address used for the request matches the one registered in your systems.

Key Considerations:

  • Protection of Sensitive Data: Provided documents must be handled confidentially and deleted once verification is completed.
  • Clarity and Transparency: Inform the requester why this information is necessary and how it will be processed.

Special Cases: When Requests Are Specific

Some requests may be made by someone other than the data subject. These cases require increased vigilance.

Legal Representative:

  • A request can be made by a guardian or legal representative (e.g., for a minor or a person under guardianship).
  • Required Documents: Proof of identity of the legal representative and justification of their authority (birth certificate, guardianship order).

Minor’s Data:

  • Minors have the same rights as adults regarding data protection.
  • Parental Consent: If the minor is of age to give their own consent (usually from 15 years old in France), they can request erasure directly. Otherwise, the request must come from a parent or guardian.

Example of Procedure: Dedicated Form or Email Request

Implementing a clear and accessible procedure facilitates request processing and reduces the risk of errors.

Which Procedure to Adopt?

  1. Online Form:
    • A dedicated form on your website allows users to detail their request.
    • Include mandatory fields such as name, email address, and an option to attach proof of identity.
  2. Email Request:
    • Provide a specific email address (e.g.: privacy@yourcompany.com) for these requests.
    • Indicate in the automatic reply the steps to follow and the required documents.

Advantages of a Dedicated Form:

  • Standardization of requests.
  • Time-saving for processing teams.
  • Reduction of missing important information.

Example of an Online Form to Facilitate Right to Erasure Requests:

Data Erasure Request

Please fill out this form to request the erasure of your personal data.







Accepted formats: JPG, PNG, PDF. Maximum size: 2 MB.





Copy the HTML Code

Note: To submit a right to be forgotten request to Mindbaz, please use this contact form.

What are the deadlines and obligations to comply with?

Legal Deadlines: How long do I have to delete the data?

The General Data Protection Regulation (GDPR) imposes a strict deadline for responding to data erasure requests:
  • Response deadline: Once the erasure request is received, you must respond within 1 month. This period can be extended by an additional 2 months if the request is complex or if you have received multiple requests.
  • Extension cases: If an extension is necessary, you must inform the concerned person of the delay within one month of the initial request.
  • Exceptions: Some exceptions may extend the deadline or make data deletion impossible (for example, to comply with a legal obligation or for the exercise of legal rights).

Key Points:

  • 1 month to respond (in general)
  • Possible extension up to 3 months in case of complexity
  • User notification if an extension is needed
🔗 Fighting Spam: The Orange / Abusix Partnership Explained

Communication: Informing the person about the progress

Maintain clear communication with the individual who submitted the data erasure request. Here are the best practices to follow:
  • Acknowledgment of receipt: As soon as you receive the request, inform the person that their data erasure request has been acknowledged.
  • Progress updates: If you need more time (for example, if the request is complex or if you need to verify the requester’s identity), keep the person informed about the status of their request.
  • Erasure confirmation: Once the data has been deleted, send a notification or email confirming the completed action. Clearly state that the data has been erased unless a legal exception prevents it.

What are the risks of not complying with data erasure requests?

What are the GDPR fine amounts?

Failure to comply with personal data erasure requests can result in severe fines under the GDPR. Here are the key amounts to know:
  • Maximum fine: The GDPR provides for fines of up to €20 million or 4% of the company’s annual global turnover, whichever is higher.
  • Fine for non-compliance with the right to erasure: If a company fails to comply with an erasure request, the fine may be applied depending on the severity of the violation, the company’s intent, and the impact on the affected individuals.

Key Points:

  • €20 million or 4% of annual global turnover: maximum fine
  • Fines adjusted based on the severity of the violation
european_regulation_right_to_be_forgotten_personal_data_gdpr_tips_mindbaz

Examples of GDPR and CNIL fines

The CNIL and GDPR authorities regularly enforce penalties. Sanctions are communicated and shared publicly. Here are some concrete examples of fines imposed for GDPR violations, including non-compliance with data erasure obligations:
  1. Google (2019): Google was fined €50 million by the CNIL for failing to comply with consent and transparency rules. While not directly related to data erasure, this example highlights the importance of respecting users’ rights, including their right to erasure.
  2. H&M (2020): H&M was fined €35.3 million for excessively collecting and storing personal information without respecting employees’ right to data erasure.
  3. Clearview AI (2022): The CNIL ordered Clearview AI to delete unlawfully collected data and imposed a €20 million fine for unauthorized biometric data collection.

Example of a Data Erasure Request

Subject: Request for Deletion of My Personal Data

Dear Sir/Madam,

In accordance with Article 17 of the GDPR, I wish to exercise my right to erasure regarding the personal data you hold about me.

Please confirm via email once my request has been processed.

Best regards,
[Full name, associated email, proof of identity]
Example of Response Email
Quiz: Do You Understand the Right to Data Erasure?

Quiz: Do You Understand the Right to Data Erasure?

1️⃣ What is the right to erasure?

2️⃣ Who can exercise the right to erasure?

3️⃣ What is the deadline for erasing data?

4️⃣ What data can be erased?

5️⃣ What right is associated with data erasure?

6️⃣ Who must respond to erasure requests?

7️⃣ What happens if the erasure request is refused?

8️⃣ What data cannot be erased?

View the Best Practices Summary

We do not collect the information provided in the quizzes of this article ✅


Source: CNIL | Understanding My Rights