Right to be forgotten
Also known as: Right to Erasure, Data Deletion Request
The right to be forgotten allows individuals to request that an organization delete their personal data when it is no longer necessary for the purpose it was collected or if consent is withdrawn. This right is not absolute and can be overridden by legal obligations, such as statutory tax record retention requirements. It ensures individuals have control over their digital footprint within a company's systems.
In practice
An auditor verifies this by sampling data deletion requests to ensure they were completed within the required timeframe across all production databases and backups. They may also review the organization's data retention policy to confirm that "deletion" is technically enforced rather than just logically hidden.