Deleting an Account Is Not the Same as Deleting Personal Data: Lessons from EU GDPR Enforcement

A coordinated European review of the right to erasure reveals practical compliance challenges for businesses — particularly those relying on multiple digital systems and external service providers.

For many digital businesses, allowing users to delete their accounts seems like a straightforward way to comply with the GDPR's right to erasure. However, removing an account from a platform does not necessarily mean that all personal data related to such an account has been deleted. Customer information may still exist in CRM systems, marketing platforms, customer-support tools, analytics environments or databases operated by external service providers. This raises the question whether a company actually knows what happens to personal data after a user requests its deletion.

What European regulators found

On 18 February 2026, the European Data Protection Board (EDPB) published the results of its 2025 Coordinated Enforcement Action on implementing the right to erasure under Article 17 GDPR. The initiative involved 32 European data protection supervisory authorities, with 764 controllers responding to the questionnaire.

The EDPB identified seven major categories of compliance challenges, including:
inadequate internal procedures for handling erasure requests,
insufficient information provided to individuals,
difficulties determining appropriate data retention periods,
challenges involving personal data stored in backups,
the use of ineffective anonymisation techniques as a (presumable) alternative to deletion.

The findings identified recurring weaknesses and areas where controllers can improve their compliance practices. For e-commerce and SaaS businesses, these findings matter because customer data often moves across interconnected systems.

Three practical steps businesses should take

1. Test whether your deletion process actually works. Choose a representative customer account and map the systems where its personal data is stored. For an online retailer, these may include, among others, the web shop database, payment-related records, CRM software, email-marketing platforms and customer-support systems. Submit a test erasure request using suitable test data and verify which systems are affected, which require separate action, and where lawful retention obligations apply.

2. Create a clear retention and deletion matrix. The right to erasure is not absolute. Under Article 17 GDPR, organisations may have legitimate grounds or legal obligations to retain certain information, even after an individual requests deletion. However, the retaining of certain records does not automatically justify keeping the same information in marketing databases or other systems where it is no longer needed or legally justified.

3. Check what happens at external service providers. Outsourcing personal data processing does not eliminate the controller's GDPR responsibilities. If a valid erasure request concerns data processed by external processors, the controller needs an effective process for ensuring that the request is implemented where required. This includes understanding how deletion requests are communicated, how completion is verified, and how backups are handled. Immediate deletion from every backup may not always be technically feasible or legally required in the same manner as deletion from active systems. However, organisations should adopt appropriate safeguards and procedures to prevent personal data from being improperly restored or reused.

Conclusion

The takeaways

The EDPB's findings remind us that GDPR compliance depends on real operational processes, not just privacy policies. The first step is often simple: test whether a valid erasure request can be handled consistently across the systems that actually store personal data. Under Article 17 GDPR, controllers must generally respond to requests without undue delay. A properly designed process should therefore support timely responses and legally accurate decisions about what must be deleted, what may be retained, and why. A functioning deletion process is therefore not just a compliance measure, but it also shows that a business understands and controls its customer data.

Article provided by INPLP member: Boris Kozlevcar (JK Law, Slovenia)