Right to erasure

A deletion request starts an assessment

A person can ask for erasure verbally or in writing and does not need to cite UK GDPR. The right can apply where data is no longer needed, consent is withdrawn and no other basis remains, processing was unlawful, a valid objection succeeds, or deletion is required by law.

The ICO's erasure guidance makes clear that the right is not absolute. An employer may still need some records to meet a legal obligation or establish, exercise or defend legal claims. The answer should be made category by category, not as one decision about the whole personnel file.

Preserve only what has a current reason

Identify the data, systems, copies, recipients and purpose behind each category. Check the lawful basis and retention rule. A payroll record needed for a statutory obligation may be retained while an obsolete profile note or duplicate local copy is deleted.

Where data has been made public or disclosed to recipients, assess the duty to communicate erasure and take reasonable steps where required. Tell processors what must be deleted and obtain useful evidence of completion.

Respond clearly and complete the work

Record the date received, verify identity proportionately and clarify scope only when needed. Respond within the applicable deadline, explaining what was erased, what was retained and the legal reason for any refusal. Include the complaint route.

Carry the outcome across the HR system, shared drives, email, exports and supplier tools. If immediate deletion from a backup is not feasible, prevent ordinary reuse and make sure the retention cycle removes it. Keep a minimal record of the request and response so the organisation can show what it did without rebuilding the deleted file.