GDPR Right to Erasure: EDPB 2025 Findings
Updated for 2026
EDPB's 2025 Erasure Action
The European Data Protection Board ran a major action in 2025. It covered GDPR Article 17 — the right to erasure. Thirty-two DPAs across the EU and EEA took part. They all acted at once. The aim was to find wide-scale failures, not one-off cases.
This action is the Coordinated Enforcement Framework, or CEF. Nine DPAs have since opened formal probes based on its results.
Seven Recurring Failures
The CEF report named seven problems found across the groups it checked:
- Weak steps for handling removal requests
- Too-broad rejection of valid requests
- Undue burden placed on people who submit requests
- Inability to locate all personal records across systems
- Delays past the 30-day GDPR response window
- Poor feedback to people about request outcomes
- Flawed anonymization used instead of deletion. Groups claimed "anonymization" but left records traceable.
The seventh item is the most complex. It hits any group that uses this method to cut down retained personal items.
Anonymization vs. Deletion
GDPR's right to erasure does not always mean full deletion. Recital 65 allows this approach when deletion is not feasible. Backup tapes and analytics systems are common cases.
The CEF shows this option is being misused. Groups label a process "anonymization" to avoid true deletion. But the process still leaves items traceable to real people.
The EDPB draws a clear line.
True anonymization means the link between items and a person cannot be rebuilt. The controller has no way to re-link them. No third party has a way to re-link them. Those items fall outside GDPR scope. The request is met.
Pseudonymization is different. Re-linking is still possible with the right key. Personal items still exist. The request is not met. The items must be deleted or the key must be destroyed.
A Two-Layer Approach
Groups that use this method in analytics need two layers.
Layer 1 — Ingestion: Raw personal items land here. These items are subject to removal requests. When a person invokes Article 17 rights, the items in this layer are deleted.
Layer 2 — Analytics: Only anonymized outputs reach this layer. If the process was complete and one-way, these outputs are not personal. They do not change when a removal request arrives.
This setup works only if the masking step meets three tests.
First: one-way. Reversible tokens and encrypted swaps do not qualify.
Second: complete. All types of identifiers must be handled. Names alone are not enough.
Third: on record. The group must be able to show a DPA how the method works.
A retailer that swaps customer names for encrypted tokens has done pseudonymization — not true removal. The analytics layer still holds personal items. Deletion requests still apply.
Our GDPR compliance guide covers the legal basis for each approach. Our security compliance overview lists the controls needed. For step-by-step help, see our GDPR anonymization audit guide.