When the right applies
Article 17 erasure applies when:
- Data is no longer necessary for the original purpose
- Subject withdraws consent (where consent was the legal basis)
- Subject objects to processing under legitimate interest, and there's no overriding legitimate ground to continue
- Data was unlawfully processed in the first place
Erasure vs. the right to object
Most guides collapse "right to be forgotten" into a single clean Article 17 request, and for consumer consent-based marketing that's roughly accurate. B2B prospecting usually doesn't work that way. If your lawful basis for holding a prospect's name, title, and company is legitimate interest, the mechanism they'll actually invoke is Article 21, the right to object, not a direct erasure request. Once a valid objection lands, you have to stop processing for that purpose unless you can demonstrate compelling legitimate grounds that override the individual's interests, which in ordinary B2B prospecting is a hard case to make. In practice the two routes converge on the same result, the record gets deleted, but treating every request as a straightforward Article 17 erasure misses the actual legal test you need to document: did you have an overriding ground, and can you show your reasoning.
Practical process
- Receive the request via email or a web form, and treat both as equally valid
- Verify identity loosely enough not to create friction, but enough to avoid impersonation-driven deletions
- Search all systems: CRM, lead lists, email sequencing tool, and backup copies
- Delete or anonymize within 30 days
- Notify the requester that it's done
- Update the audit log with what was deleted, when, and under which article
Backups and the 90-day rule
Backups are the part of this that trips teams up, because backup systems generally aren't built to selectively scrub one record on demand. Most regulators accept that backup erasure lags behind live-system erasure, given normal backup retention and rotation cycles, as long as the backup isn't actively restored or used for processing in the meantime. 90 days is a commonly cited, defensible standard for full backup-copy expiry. What matters for an actual audit is having a written retention policy that states the window and evidence that you follow it, not the specific number itself.
Exceptions to erasure
You can refuse erasure if:
- The data is needed to establish, exercise, or defend a legal claim
- A statutory retention obligation applies (tax records: 7 years in France, for example)
- A genuine public-interest ground applies (rare in ordinary B2B prospecting)
None of these are blanket excuses. Each one has to map to the specific record in question, "we might need it someday" isn't a legal claim, and a regulator reviewing a complaint will expect you to point at the specific exception you're relying on.
Frequently asked questions
What's the difference between the right to be forgotten and the right to object for B2B prospecting?
Article 17 erasure is what most people mean by right to be forgotten, and it applies cleanly when consent was the legal basis and gets withdrawn. But most B2B prospecting relies on legitimate interest, not consent, so the right a prospect actually exercises is usually Article 21, the right to object. If you can't show an overriding legitimate ground to continue, the practical outcome is the same: you delete the record. The legal route there is just different.
How long do I have to respond to an erasure or objection request?
30 days as the standard response window, extendable by up to 60 more days for genuinely complex requests, with the requester notified of the extension and the reason within the original 30 days.
Do backups have to be purged immediately too?
Not immediately. Most regulators accept that backup systems operate on their own retention cycle and that scrubbing an individual record from every backup the moment a request arrives isn't technically realistic. A defensible, documented backup-purge window, 90 days is a commonly cited standard, is generally accepted as long as the live production record is deleted right away and the backup copy isn't actively used in the meantime.
Can I ever refuse an erasure request?
Yes, in specific cases: if you need the data to establish, exercise, or defend a legal claim, if a statutory retention obligation applies (French tax records must be kept 7 years, for example), or in the rare B2B case where a genuine public-interest ground exists. The refusal has to map to one of the listed exceptions, not just business convenience.
General information only, not legal advice; confirm current requirements and your specific lawful basis with counsel.
Leadsforlinked supports erasure SLAs.
30-day deletion. 90-day backup expiry. Free 100 leads on signup.
Start free