MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
If you receive a request to erase personal data (the right to be forgotten, Article 17 GDPR) and you have shared that data with other controllers, you must take reasonable measures to inform them of the erasure request as well. The Court of Justice confirmed this.
The right to be forgotten
Under the GDPR, a data subject may, subject to conditions, request the erasure of their personal data (Article 17 GDPR). If the request meets the conditions, you must delete the data. But what if you have since shared that data with others?
You must inform other responsible parties
If you have made the data public or shared it with other controllers, you have a duty to take reasonable measures to inform those others of the request for erasure (Article 17(2) GDPR). This allows them to assess whether they should delete the data (and any copies or links). The Court of Justice has confirmed this obligation in a ruling.
What are reasonable measures?
What is reasonable depends on the available technology and the costs. You do not have to do the impossible, but you must make a serious, demonstrable effort to reach the other parties. Keep track of who you have shared the data with so that you can inform them if necessary.
What does this mean for you?
Map out with which parties you share personal data and document this. Establish a process to correctly handle erasure requests, including informing other data controllers. This ensures compliance with the GDPR and prevents data from floating around elsewhere.
Frequently Asked Questions
Do I also need to inform others regarding a deletion request?
If you have shared or made public the data with other controllers, you must take reasonable measures to inform them of the request (Article 17(2) GDPR).
What are reasonable measures?
A serious, demonstrable effort, depending on the technology and costs. You do not have to do the impossible.
How do I prepare?
Keep track of who you share data with and set up a process to correctly handle deletion requests.
Are your GDPR processes in order?
Our legal experts draft your privacy statement and data processing agreement and set up your request handling. View our privacyteam or schedule a free consultation.
