Cyprus GDPR erasure requests: a controller decision guide

Recognise the request and start a response clock

Treat the substance of a message as the request. A customer may write to support asking for account deletion, an applicant may ask HR to remove a CV, or a former client may ask that marketing data be erased. None needs to quote the GDPR or use a prescribed form. Record when the organisation received the request, its exact wording, the channels and accounts involved, and who is coordinating the decision. Route requests from sales, support and HR promptly so that an internal forwarding delay does not become an unexplained late response.

Article 12 requires action without undue delay and generally within one month of receipt. A complex request or several requests may justify up to two additional months, but the person must be told of the extension and reasons within the initial month. Do not use an extension simply because a team forgot to start searching. Acknowledge receipt in a practical way, but distinguish an acknowledgement from the substantive response. Record the date used for the calculation and the decision on any extension.

A single message can combine erasure with access, objection to marketing, correction and account closure. Split the legal questions and coordinate one understandable response. Account closure by itself does not prove that every personal-data copy has been erased. Conversely, retaining an invoice required by law does not justify continuing to send promotional emails. Give each data set and purpose a separate status in the request file so the organisation can explain precisely what it did.

For the different task of supplying a person with their data, use the Cyprus access-request guide.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: Respect individuals' rights; Cyprus Commissioner for Personal Data Protection: GDPR overview and data-subject rights

Confirm identity proportionately and define the data scope

A controller may ask for additional information where it has reasonable doubts about the requester's identity. The risk differs between a request sent from an authenticated account and one from an unfamiliar address asking to delete another person's employment file. Ask only for what is needed to resolve the doubt, and document why. Do not routinely demand a passport copy for every request when account verification or a narrower check will do. Sending sensitive identity documents through an insecure channel can create a new problem while trying to solve the first.

Identify the controller's data locations: customer account, CRM, support tickets, billing system, marketing lists, analytics identifiers, document store, employee folders, archived systems and processors. Ask the relevant owners which personal data they hold about this person and for what purpose. Search should be reasonable and mapped to known data flows, not limited to the main application database. A deletion button in the app may leave a connected mailing tool or export untouched. Record the systems actually checked and the method used to match the requester.

Clarify a genuinely ambiguous scope when needed, without turning clarification into a barrier. The requester may mean a particular service account or every relationship with the organisation. Where the business has several roles, including processor for another controller, identify who decides the purpose and means of the specific processing. A processor should route a request under its controller contract instead of independently deciding to erase the controller's records. Keep the requester's stated objective visible throughout the analysis.

The processor/controller distinction also affects contracts; see the Article 28 processor-agreement guide.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: Respect individuals' rights

Assess the Article 17 grounds purpose by purpose

Article 17(1) lists situations in which erasure is required without undue delay. They include data no longer necessary for the purpose collected, withdrawal of consent where no other legal ground supports processing, a successful objection under Article 21, unlawful processing, erasure required by law and certain data collected from a child in connection with information-society services. The controller should identify the ground that applies to each relevant processing activity instead of giving a generic answer that the 'right to be forgotten' is absolute.

Purpose matters. A mailing-list address collected solely for consent-based newsletters may no longer be needed after withdrawal, while the same address on a completed invoice may be processed under a separate legal obligation. Do not relabel consent-based marketing as a contract necessity after the person withdraws consent merely to keep using the list. Conversely, do not delete a legally required invoice because marketing consent ended. Record the data category, original purpose, legal basis, current necessity and decision. This produces an auditable answer to both over-deletion and under-deletion.

If the person objects to direct marketing, Article 21(2) and (3) require that processing for that purpose stop. Consider the related erasure ground in Article 17(1)(c) and what minimal suppression information may still be needed to respect a do-not-contact choice. An objection to processing based on public interest or legitimate interests involves a different assessment under Article 21(1). The legal route affects the decision; a standard template that calls every request 'withdrawal of consent' can obscure it.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: Respect individuals' rights

Use Article 17 exceptions narrowly and explain partial outcomes

Article 17(3) limits erasure to the extent processing is necessary for specific reasons. They include freedom of expression and information, a legal obligation or certain public tasks, specified public-health interests, protected archival or research purposes, and the establishment, exercise or defence of legal claims. The word 'necessary' matters. An organisation should point to the particular law or live claim that justifies retaining particular data, not assert that it keeps everything for possible future use. Preserve only what the exception requires and restrict unrelated use.

A Cyprus business may need to retain transaction records for tax and accounting purposes, or relevant material for a concrete dispute. Verify the applicable instrument and retention period for that record rather than inserting a universal number into the privacy response. Separate a financial document from a marketing profile or duplicate support export. An erasure request can therefore be granted for some data and refused for other data. State the categories and reasons clearly; a blanket 'we cannot delete your data because of legal obligations' conceals the decision the controller actually made.

The EDPB's 2026 coordinated enforcement report notes that controllers struggle with conditions for erasure, exception balancing and retention periods. Use a short decision note for each contested category: requester's ground, controller's reason to retain, legal source, necessity, restriction applied and planned review date. If legal claims are invoked, identify the dispute or credible claim context and reassess when it ends. Treat anonymisation with care: a weak substitute that still permits re-identification is not erasure.

For ordinary retention periods and legal holds outside a request, maintain a GDPR retention schedule.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: 2026 coordinated enforcement report on the right to erasure

Delete across production systems, processors and backups

Once the decision is made, convert it into system-specific actions. Delete or irreversibly de-identify applicable records in the customer application, CRM, marketing platform, ticketing tool, document store and other identified systems. Record the method and completion date. Where a processor acts for the controller, send a precise instruction through the agreed channel and seek confirmation of completion or an explained limitation. A closed support ticket or a deleted front-end account is not evidence that all matching records were handled.

Backups require a technically realistic plan. A live backup may not support selective deletion without undermining recovery, but it should not become an indefinite hidden copy restored into active use. Document rotation periods, access restrictions and a restoration procedure that reapplies the erasure decision before restored data is used. The EDPB's 2026 report identifies backup deletion as a recurring difficulty. Do not promise instantaneous removal from every backup if the architecture cannot deliver it; explain and test the actual control used.

Verify completion by targeted searches and records, not only by checking a work ticket. Test that the person is removed from active marketing, no longer appears in the service account, and is not recreated by a nightly sync. Preserve limited evidence of the request and the controller's response to demonstrate compliance, with its own defined retention and access controls. A deletion log should not unnecessarily replicate the personal data that the request sought to remove. Assign ownership for delayed processor confirmations and failed technical jobs.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: 2026 coordinated enforcement report on the right to erasure

Notify recipients and address data made public

Article 19 requires a controller that has disclosed personal data to recipients to communicate erasure to each recipient unless doing so is impossible or involves disproportionate effort. The controller must inform the person about those recipients if requested. Maintain a recipient map so the organisation knows which service providers, partners or other recipients received the relevant data. A general supplier list is useful, but the actual request needs the recipients relevant to the data being erased. Record notices sent and any documented impossibility or disproportionate effort.

Article 17(2) adds a duty where a controller made the personal data public and is obliged to erase them: taking account of available technology and implementation cost, it must take reasonable steps to inform other controllers processing those data that the person requested erasure of links, copies or replications. This is not a guarantee that the controller can purge the entire internet. Identify what it published, where it can remove the material directly and which other controllers should be notified. Keep evidence of reasonable steps and responses.

Do not confuse a processor instruction with the Article 19 recipient obligation or Article 17(2) public-data steps. The duties can overlap operationally but have different legal triggers. A platform might erase a profile from its own database, tell an email provider to remove the record and separately notify another controller that copied a public directory entry. Build the case checklist around these routes so a single 'vendors notified' box does not hide an unexamined publication.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: Respect individuals' rights

Give a clear decision, even when erasure is refused

Tell the person what was erased, what was retained and why, in language that can be understood without access to internal systems. Avoid exposing other people's personal data or sensitive security details while explaining the categories. Article 12 requires information in a concise, transparent and intelligible form. If the controller does not act on the request, it must explain the reasons within one month and identify the possibility of a supervisory-authority complaint and judicial remedy. A silent account deletion or vague 'request processed' message leaves the person unable to assess the outcome.

Be precise about partial deletion. For example, confirm that promotional data and the profile were removed, while specified invoice records remain under a verified legal obligation and will not be used for marketing. If a backup copy is subject to restricted access and scheduled rotation, describe the practical limitation accurately. Do not use the response to claim a lawful basis or statutory retention period that has not been checked. Keep the response date, channel and wording in the case file.

An extension or identity query needs its own communication. If the request is complex enough for more time, notify the person within the initial month and explain the reason. If there are reasonable doubts about identity, explain the minimum additional information needed and how to provide it securely. Do not apply a charge as the default; Article 12 permits a reasonable fee or refusal only for a request the controller can demonstrate is manifestly unfounded or excessive, in particular repetitive. Record that justification if used.

The general rights-response structure is also used for access requests, but the erasure decision and its exceptions must be assessed separately.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: Respect individuals' rights

Build a repeatable review process

Create a case template with receipt date, identity check, data systems, Article 17 ground, applicable exception for each category, deletion tasks, recipient notices, backup treatment, response and follow-up. Give the privacy lead authority to resolve disputes between system owners about whether a record is still needed. Test the process with a scenario that includes a CRM lead, newsletter entry, paid invoice, support ticket and a processor-held export. The correct result may differ across those records even though they relate to one person.

Review the data map and retention schedule after repeated erasure requests expose the same stale records. If the organisation routinely keeps information long after its purpose ends, the root problem is ordinary retention practice, not only the handling of requests. The EDPB's coordinated action highlights missing procedures, inadequate explanations, weak anonymisation and uncertainty around backups. Measure whether requests are answered on time and whether deletions actually propagate through integrations, rather than counting closed tickets alone.

Finally, audit changes to the stack. A new marketing tool, cloud backup or support provider can add a data copy the old process does not reach. Update processor instructions and the recipient map when contracts change. Rehearse a restoration to ensure an erased profile is not reintroduced. A well-documented decision is useful only if the technical steps match it. Keep this guide distinct from an access-request checklist: erasure is a purpose-by-purpose legal and operational judgment, not a search-and-export exercise.

Where the request follows a security incident, the separate breach-response guide covers notification and containment duties.

Basis and guidance: Regulation (EU) 2016/679, Articles 12, 17, 19 and 21; European Data Protection Board: 2026 coordinated enforcement report on the right to erasure

Primary sources and scope

Sources checked: October 7, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Regulation (EU) 2016/679, Articles 12, 17, 19 and 21
• European Data Protection Board: Respect individuals' rights
• European Data Protection Board: 2026 coordinated enforcement report on the right to erasure
• Cyprus Commissioner for Personal Data Protection: GDPR overview and data-subject rights

Practical guides for this topic

• GDPR marketing objections in Cyprus: stop and suppress

  A practical Cyprus controller workflow for Article 21 direct-marketing objections, suppression records, CRM sync, profiling and responses.