Deadlines, process and best practices for GDPR right to erasure in B2B sales
Legal Compliance··5 min read
Key takeaways
You have 30 calendar days to respond to a data deletion request under Art. 17 GDPR. Not responding is a serious infringement
The process is straightforward: verify identity, delete from all systems, confirm to requester and document everything
Working with Vonsel and verified public data simplifies the process, since every data point has a traceable origin
To handle a data deletion request under GDPR, confirm who is asking, find the person's records in every system, delete them, tell the requester what you removed, and keep a written record. You must respond within one month of receiving the request, and that period can be extended by two further months for complex cases.
Fundamentals
What is the right to erasure and when does it apply?
The right to erasure (Art. 17 GDPR), known as the "right to be forgotten", allows anyone to request deletion of their personal data. In B2B prospecting, if a contact asks you to delete their data, you must comply.
This right applies when data is no longer necessary, when the data subject objects, or when it was processed unlawfully. If someone in your database asks to be deleted, you must always comply.
A clear process turns this into a 5-minute task. Using verified public data makes traceability easy. The ICO provides a thorough guide on implementing data protection by design and by default, which is essential for building deletion-ready systems from the start.
30d
maximum deadline to respond to a data deletion request under GDPR
Source: Regulation (EU) 2016/679, Art. 12.3
30d
maximum legal response deadline
48h
recommended internal processing time
+180%
increase in deletion requests since 2020
Method
5 steps to handle a deletion request
1
Verify requester identity
Confirm they are who they claim. An email from the address on file is usually sufficient.
2
Locate all data
CRM, spreadsheets, backups, email lists. Search every system where the contact may appear.
3
Delete from all systems
Remove the complete record. If your CRM has cleaning functions, you can automate this.
4
Confirm to the requester
Email confirmation stating what data you held and from which systems you removed it. Within 30 days.
5
Document everything
Record request, date, data deleted and confirmation. This is your compliance proof for any authority. Spain's LOPDGDD (Ley Organica 3/2018) complements the GDPR with additional Spanish-specific requirements on data subject rights.
Deletion requests are not a problem: they are an opportunity to demonstrate professionalism. 65% of contacts who receive swift confirmation improve their perception of the company. The AEPD has published a practical guide to help businesses comply with GDPR, including handling data subject requests efficiently.
Traceable data, easy to manage
With Vonsel every data point has a verified, documented source. Simplifies GDPR request management.
If you build prospect lists with Vonsel, every record comes from a public Google Maps listing, so you can trace it back when a deletion request arrives. You can compare plans on the pricing page or watch the video tutorial to see an extraction from start to finish.
Frequently asked questions
How long do I have to respond to a deletion request?
GDPR sets a maximum of 30 calendar days. Can be extended by 60 days in complex cases, but you must inform the requester within the first 30 days.
Can I refuse to delete data?
Only exceptionally: legal obligation, defending legal claims, or public interest. In B2B prospecting, these almost never apply.
What if I do not respond?
Serious GDPR infringement. Can lead to complaints and fines up to 20 million euros. Also damages company reputation.
Do I have to delete data from backups too?
Yes, if the request is valid and no exemption applies, the erasure has to reach backup systems as well as live ones. The ICO accepts that backup copies may stay until they are overwritten on a normal schedule, provided you put them beyond use and do not touch them for any other purpose. Note this decision in your request log.
How do I verify the identity of someone asking for deletion?
Ask only for what you need to be reasonably sure the person is who they say they are. Under Article 12 of the GDPR you may request additional information when you have reasonable doubts about identity. For an existing contact, a reply from the email address you already hold is often enough. Write down how you checked, and avoid collecting more personal data than the check needs.
Can I automate user data access and deletion requests?
Partly. You can automate the intake with a dedicated email address or web form, send an automatic acknowledgement, search your CRM and email lists for the contact, and generate a deletion log. Keep a person involved for identity checks and unusual cases, such as data you must keep for a legal claim. Knowing where each record came from makes the search step much quicker.
Does the right to erasure cover business contact details?
Yes, when the details identify a specific person. A named employee's work email address is personal data under GDPR even in a B2B setting. A generic company inbox that points to no one in particular is generally treated differently. If a named contact asks you to delete their details, assume the request applies and handle it as described above.
What if a deletion request is manifestly unfounded or excessive?
Article 12 of the GDPR lets you either charge a reasonable fee or refuse to act, but you carry the burden of showing the request is manifestly unfounded or excessive. If you refuse, tell the person without delay, and at the latest within one month, why you did so and that they can complain to the supervisory authority.
Sources
Article 12 of the GDPR: the one-month response period, the possible two-month extension, identity checks and manifestly unfounded or excessive requests.
AEPD guide for businesses: the Spanish authority's guide (in Spanish) for businesses and public bodies on complying with data protection rules when creating data spaces.
