Having a deletion policy is one thing; its effective implementation in day-to-day business operations is quite another. A recent case from France illustrates just how costly the gap between intention and practice can be: on 21 July 2026, the French data protection authority, the CNIL, imposed a fine of \u20ac300,000 on the company EXTIA for systematic breaches of the right to erasure.<\/p>\n\n\n\n
Of the 265 requests for erasure received in 2024, more than three-quarters were either not processed at all or were not dealt with satisfactorily. Twelve requests remained completely unanswered, 166 data subjects were not informed of the outcome, and 27 only received a response after a delay of several months.<\/p>\n\n\n\n
The key finding: a documented deletion policy does not protect against sanctions if the processes do not work in practice.<\/strong> This applies to the processing of erasure requests as well as to backups, data recovery and the question of when data is actually anonymised rather than merely masked.<\/p>\n\n\n\n What supervisory authorities really expect<\/strong><\/p>\n\n\n\n In February 2026, the European Data Protection Board (EDPB) published the results of its Europe-wide audit on the right to erasure. Thirty-two supervisory authorities examined 764 organisations and identified seven recurring vulnerabilities. Five of these directly concern practical implementation \u2013 including a lack of processes, inadequate training and problematic backup strategies.<\/p>\n\n\n\n How can such vulnerabilities be avoided? And how does a documented requirement become a deletion process that works technically and can be reliably implemented in day-to-day operations?<\/p>\n\n\n\n Our webinar on 3 November 2026 at 4 pm<\/strong> will address these questions: \u201cFrom retention periods to erasure requests: Deletion Concepts that actually work\u201d<\/strong><\/p>\n\n\n\n Stefanie Bauer will demonstrate how deletion policies can be designed and implemented in such a way that they are effective in practice. Having a deletion policy is one thing; its effective implementation in day-to-day business operations is quite another. A recent case from France<\/p>\n
Register now<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"