GDPR Right to Erasure: EDPB 2025 Findings
Updated for 2026
EDPB's 2025 Erasure Action
The European Data Protection Board ran a major action in 2025. It covered GDPR Article 17 — the right to erasure. Thirty-two DPAs across the EU and EEA took part. They all acted at once. The aim was to find wide-scale failures, not one-off cases.
This action is the Coordinated Enforcement Framework, or CEF. Nine DPAs have since opened formal probes based on its results.
Seven Recurring Failures
The CEF report named seven problems found across the groups it checked:
- Weak steps for handling removal requests
- Too-broad rejection of valid requests
- Undue burden placed on people who submit requests
- Inability to locate all personal records across systems
- Delays past the 30-day GDPR response window
- Poor feedback to people about request outcomes
- Flawed anonymization used instead of deletion. Groups claimed "anonymization" but left records traceable.
The seventh item is the most complex. It hits any group that uses this method to cut down retained personal items.
Anonymization vs. Deletion
GDPR's right to erasure does not always mean full deletion. Recital 65 allows this approach when deletion is not feasible. Backup tapes and analytics systems are common cases.
The CEF shows this option is being misused. Groups label a process "anonymization" to avoid true deletion. But the process still leaves items traceable to real people.
The EDPB draws a clear line.
True anonymization means the link between items and a person cannot be rebuilt. The controller has no way to re-link them. No third party has a way to re-link them. Those items fall outside GDPR scope. The request is met.
Pseudonymization is different. Re-linking is still possible with the right key. Personal items still exist. The request is not met. The items must be deleted or the key must be destroyed.
A Two-Layer Approach
Groups that use this method in analytics need two layers.
Layer 1 — Ingestion: Raw personal items land here. These items are subject to removal requests. When a person invokes Article 17 rights, the items in this layer are deleted.
Layer 2 — Analytics: Only anonymized outputs reach this layer. If the process was complete and one-way, these outputs are not personal. They do not change when a removal request arrives.
This setup works only if the masking step meets three tests.
First: one-way. Reversible tokens and encrypted swaps do not qualify.
Second: complete. All types of identifiers must be handled. Names alone are not enough.
Third: on record. The group must be able to show a DPA how the method works.
A retailer that swaps customer names for encrypted tokens has done pseudonymization — not true removal. The analytics layer still holds personal items. Deletion requests still apply.
Our GDPR compliance guide covers the legal basis for each approach. Our security compliance overview lists the controls needed. For step-by-step help, see our GDPR anonymization audit guide.
When This Approach Has Limits
The two-layer split — delete raw items, keep only one-way anonymized outputs in analytics — is a sound way to honor erasure without breaking analysis. But limits remain worth stating plainly.
One-way is harder to prove than to claim. The CEF's seventh failure was exactly this: groups labeled a process anonymization while leaving records traceable. Passing a one-way step depends on detection recognizing every identifier first, and detection carries a residual false-negative rate. A free-text note or an overlooked field can keep a record linkable even after the visible identifiers are gone. Test the analytics output for re-identifiability against real adversary knowledge, not just against the fields you intended to remove.
Quasi-identifiers survive direct removal. Even when names and IDs are stripped, combinations like postcode plus age plus a rare attribute can single someone out. An output that still permits this is pseudonymized, not anonymized, which means it stays in GDPR scope and an erasure request still reaches it. The distinction carries legal consequences, so the completeness test must cover indirect identifiers and their combinations, not only the direct ones the example lists.
The standard is a legal judgment, not a tool output. Whether re-identification is impossible by any means reasonably likely to be used is something a DPA decides, weighing the controller's and third parties' realistic capabilities. A tool can support the method and produce the record, but the EDPB expects documented human reasoning about why the link cannot be rebuilt. Keep an accountable person making and recording that call before you treat any analytics layer as outside scope.