EDPB publishes CEF final report on right to erasure

The European Data Protection Board (EDPB) has published its final report on its 2025 coordinated enforcement action concerning the right to erasure under the Eu General Data Protection Regulation (GDPR). The coordinated action involved 32 national authorities, resulting in responses from 764 data controllers and nine formal investigations by national data protection authorities (DPAs). The report identifies the right to erasure as one of the most frequently exercised rights and a common source of complaints by individuals.

The findings highlight several recurring challenges, including a lack of internal procedures for handling requests and insufficient information provided to individuals. Data controllers also reported difficulties in balancing erasure against other legal rights and determining appropriate data retention periods. In addition, the report highlights the use of inefficient anonymisation techniques as an alternative to deletion, as well as inconsistent practices in determining retention periods and removing data from backup systems. The EDPB notes similarities with the findings of its 2024 coordinated enforcement action on the right of access.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.