What do I do when someone requests that their personal data is to be deleted?

One of the fundamental rights of data subjects is the right to have their data deleted, or in other words, to be "forgotten". If a data subject makes a request of its’ personal data to be deleted, the main rule is that you must delete them. However, there are some exceptions when the data is not to be deleted. The exceptions often apply if the person responsible for personal data is an authority or performs a task of general interest. You can, among other things, refuse the data subject deletion if it is necessary to maintain other important rights, such as the rights to freedom of speech or information, to fulfill a legal obligation, or to be able to establish, assert or defend legal claims. Regardless of whether you delete the information or have a reason to keep it, you must reply to the data subject without undue delay, i.e. no later than one month after you have received the request.