A person asks for their data to be deleted: what should we do?
By Advisorn · updated on 25 October 2026 · Art. 6 para. 4, 30-32 FADP, Art. 12 and 17 GDPR
In short
A person may ask for their data to be deleted, in particular when it is no longer needed or is processed against their will (Art. 30 para. 2 let. b and Art. 32 FADP). The business deletes it, unless it must keep it by law or has another ground for justification, and answers saying what it has deleted, what it keeps and why. Under the GDPR the right to erasure is in Art. 17 and the answer is due within one month.
The steps
- verify the identity of the person asking;
- look for the data in every activity of the record, in backups and at the vendors;
- separate what you must keep (for example invoices, ten years) from what you can delete;
- delete or anonymise, and ask the vendors to do the same;
- answer in writing and note the request and the answer.
Deadlines
The FADP sets no deadline for deletion; answering within 30 days, as for the right of access, is a good rule. Data that must be kept by law is blocked for any other use until the period expires.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.