What is the most common mistake organizations make when responding to a request to delete someone's personal data?

When someone asks an organization to delete their personal data, the request feels simple: find the data, erase it, confirm it is gone. In practice, the most common mistake is treating deletion as an all-or-nothing action and acting on it too quickly, before checking whether the data is actually eligible to be deleted.

The Core Mistake: Deleting Without Checking Obligations

Organizations frequently delete personal data on request without first verifying whether a competing legal obligation requires them to keep it. A deletion (“erasure”) right is almost never absolute. Records subject to a retention requirement, an active investigation, an audit, litigation, or a legal hold generally must be preserved, even when the individual asks for removal.

Destroying data that is under a legal hold or a mandated retention period can expose the organization to spoliation claims, regulatory penalties, and loss of evidence. The correct first step is to pause and ask: Are we permitted to delete this, in full or in part?

Related Pitfalls

• Over-deletion. Erasing far more than the request covers, including records the organization is legally required to keep or that belong to other people.
• Missing copies. Deleting the primary record but overlooking backups, archives, logs, exports, third-party processors, and analytics systems where the same data persists.
• No verification of identity. Deleting data based on an unverified request, which can itself become a privacy breach.
• No documentation. Failing to record what was deleted, what was retained, and why. The decision trail is often as important as the deletion itself.

How to Handle It Correctly

A defensible deletion process treats the request as a controlled records action, not a quick fix:

1. Verify the requester’s identity and confirm the scope of the request.
2. Map where the personal data lives across all systems and copies.
3. Check retention schedules, legal holds, and statutory obligations before acting.
4. Delete what is eligible; suppress or restrict what must be retained, and explain the carve-out.
5. Document the outcome and confirm completion to the requester.

Mapping data, weighing obligations, and recording decisions are core privacy and governance disciplines. For more on managing personal and sensitive information responsibly, see the privacy and PII topic hub.