Right to be Forgotten in B2B Prospecting (2026)

When the right applies

Article 17 erasure applies when:

• Data is no longer necessary for the original purpose
• Subject withdraws consent (where consent was the basis)
• Subject objects to processing (under legitimate interest basis) and there's no overriding interest
• Data was unlawfully processed

Practical process

1. Receive request via email or web form
2. Verify identity (avoid impersonation deletions)
3. Search all systems: CRM, lead lists, email tool, backup copies
4. Delete or anonymize within 30 days
5. Notify subject of completion
6. Update audit log

Backups and the 90-day rule

Backups are tricky. Most regulators accept that erasure of backup copies takes longer due to backup retention cycles. 90 days is a defensible standard. Document your retention policy.

Exceptions to erasure

You can refuse erasure if:

• Data is needed for legal claims defense
• Statutory retention obligations apply (tax records: 7 years in France)
• Public interest applies (rare in B2B)