[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F17":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","17","Article 17","Right to erasure ('right to be forgotten')",90,"General Data Protection Regulation","**What it asks for.** Individuals have the right to have their personal data erased without undue delay where one of the listed grounds applies, for example the data are no longer needed, consent is withdrawn, the individual successfully objects or the processing is unlawful. Where data have been made public, the controller must take reasonable steps to inform others processing it. The right does not apply in some cases, such as where processing is needed for a legal obligation or legal claims.\n\n**In practice.** Organisations have a request process that verifies identity, assesses whether erasure applies and locates the data across systems, backups and processors. Evidence includes a request log, response times, documented reasons for any refusal and technical procedures for deletion or suppression.\n\n**Common gaps.** Data is often deleted from the main system but remains in copies, exports, analytics platforms or processor systems. Backups need a documented approach, such as preventing restored data from being used.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_17","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},85,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","2026-10-12T12:20:36.995+00:00",{"slug":24,"title":25,"published_at":26},"court-orders-gambling-operator-to-honour-gdpr-data-access-request-after-unlawful-refusal","Court Orders Gambling Operator to Honour GDPR Data Access Request After Unlawful Refusal","2026-10-12T10:20:23.374+00:00",{"slug":28,"title":29,"published_at":30},"bbva-fined-55m-for-ignoring-customer-marketing-opt-out-for-seven-months","BBVA Fined €5.5M for Ignoring Customer Marketing Opt-Out for Seven Months","2026-10-09T08:20:27.832+00:00",{"slug":32,"title":33,"published_at":34},"cjeu-rules-individuals-may-request-erasure-from-church-baptism-registers-under-gdpr","CJEU Rules Individuals May Request Erasure from Church Baptism Registers Under GDPR","2026-10-07T14:21:27.964+00:00",{"slug":36,"title":37,"published_at":38},"cjeu-rules-individuals-can-demand-erasure-from-church-baptismal-records-under-gdpr","CJEU Rules Individuals Can Demand Erasure from Church Baptismal Records Under GDPR","2026-10-06T16:21:42.897+00:00",{"slug":40,"title":41,"published_at":42},"cjeu-rules-annotation-is-not-erasure-gdpr-applies-to-baptismal-registers","CJEU Rules Annotation Is Not Erasure: GDPR Applies to Baptismal Registers","2026-10-06T16:20:54.673+00:00",{"slug":44,"title":45,"published_at":46},"cjeu-opinion-gdpr-right-to-erasure-applies-to-church-baptismal-registers","CJEU Opinion: GDPR Right to Erasure Applies to Church Baptismal Registers","2026-10-06T08:20:36.043+00:00",{"slug":48,"title":49,"published_at":50},"cjeu-rules-physical-church-baptismal-registers-fall-under-gdpr","CJEU Rules Physical Church Baptismal Registers Fall Under GDPR","2026-10-06T08:20:21.201+00:00",{"slug":52,"title":53,"published_at":54},"greek-dpa-fines-dei-and-call-center-partners-880k-for-gdpr-marketing-violations","Greek DPA Fines DEI and Call-Center Partners €880K for GDPR Marketing Violations","2026-10-05T10:20:23.718+00:00",{"slug":56,"title":57,"published_at":58},"extia-fined-300k-for-failing-to-honor-gdpr-data-erasure-requests","EXTIA Fined €300K for Failing to Honor GDPR Data Erasure Requests","2026-09-29T16:21:21.431+00:00",{"slug":60,"title":61,"published_at":62},"300k-gdpr-fine-for-mishandling-75-of-erasure-requests","€300K GDPR Fine for Mishandling 75% of Erasure Requests","2026-09-29T14:20:25.731+00:00",{"slug":64,"title":65,"published_at":66},"italian-hospital-fined-30k-for-refusing-gdpr-erasure-request-on-recruitment-data","Italian Hospital Fined €30K for Refusing GDPR Erasure Request on Recruitment Data","2026-09-29T10:20:37.588+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",24,{"slug":74,"name":75,"problem":76,"stories":77},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",22,{"slug":79,"name":80,"problem":81,"stories":82},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",11,{"slug":84,"name":85,"problem":86,"stories":87},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",7,{"slug":89,"name":90,"problem":91,"stories":92},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",5,{"slug":94,"name":95,"problem":96,"stories":97},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,[99,105,110,115,120,126,131,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","3","Control 3","Data Protection",72,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",58,{"family":111,"item":107,"code":112,"title":113,"together":114},"nist-privacy","Privacy Framework","NIST Privacy Framework",55,{"family":5,"item":116,"code":117,"title":118,"together":119},"5","Article 5(1)(f)","Principles relating to processing of personal data",46,{"family":121,"item":122,"code":123,"title":124,"together":125},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",43,{"family":5,"item":127,"code":128,"title":129,"together":130},"6","Article 6","Lawfulness of processing",35,{"family":132,"item":133,"code":134,"title":135,"together":136},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",16,{"family":100,"item":138,"code":139,"title":140,"together":141},"14","Control 14","Security Awareness and Skills Training",15]