What it asks for. Individuals have the right to have their personal data erased without undue delay where one of the listed grounds applies, for example the data are no longer needed, consent is withdrawn, the individual successfully objects or the processing is unlawful. Where data have been made public, the controller must take reasonable steps to inform others processing it. The right does not apply in some cases, such as where processing is needed for a legal obligation or legal claims.
In practice. Organisations have a request process that verifies identity, assesses whether erasure applies and locates the data across systems, backups and processors. Evidence includes a request log, response times, documented reasons for any refusal and technical procedures for deletion or suppression.
Common gaps. Data is often deleted from the main system but remains in copies, exports, analytics platforms or processor systems. Backups need a documented approach, such as preventing restored data from being used.