A customer asks for erasure, how do I handle that technically?
The right to erasure is not a single button. You need to know where the data sit, what you may actually delete, and what you must keep under other laws.
Try this first
- 1Map where the data live: CRM, accounting, mail archive, backups, support tickets, newsletter tool, analytics. A map per record helps.
- 2Check retention obligations. Invoices fall under tax law, complaints often have a limitation period. You may keep what you genuinely need, but document why.
- 3Decide per system: hard delete where possible, otherwise structured anonymisation or move to a sealed retention zone.
- 4Backups do not get wiped immediately. Document that the data are gone from the primary system and will roll out at the next backup rotation.
- 5Confirm in writing what was deleted and what you retain, on what basis, and for how long.
When to bring us in
If requests clash with tax or labour-law retention, a GDPR lawyer helps you ground the trade-off.
See also
- Does NIS2 apply to my company?Two questions decide it: are you in a listed sector, and do you meet the threshold from Recommendation 2003/361/EC (more than 50 FTE and more than EUR 10M turnover or balance sheet). Below that you are only indirectly in scope, via your customers. The threshold determines whether you are an important or essential entity depending on sector.
- What changes with the Dutch Cyber Security Act?The Cyberbeveiligingswet is the Dutch implementation of NIS2. Track NCSC for the exact effective date and the lower regulations.
- Am I personally liable as a director under NIS2?Yes. The board is accountable for approving and overseeing the cyber measures. Severe negligence can become personal.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.