They said this… · Data protection & SARs

“If you ask for erasure, an organisation must delete every record about you”

Generally incorrect

The right to erasure is qualified and does not apply in every circumstance.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • Legal obligations, legal claims and other lawful grounds can justify continued retention.
  • The controller should identify why an exception/lawful basis applies to the data retained.
  • Erasure and accuracy are different rights.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.