CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
An EU citizen contacts an online retailer and formally requests that all personal data the company holds about them be permanently deleted from its cloud databases. Under GDPR, this request invokes which data subject right?
- ARight to rectification
- BRight to erasure
- CRight to object
- DRight to data portability
Show answer & explanationAnswer & explanation
Correct answer: B. Right to erasure
The GDPR's right to erasure (also called the 'right to be forgotten') under Article 17 allows individuals to request deletion of their personal data when it is no longer needed or consent is withdrawn.
Why the other options are wrong
- A. Rectification allows correction of inaccurate data, not deletion.
- C. Right to object allows individuals to stop certain processing activities, not necessarily delete all data.
- D. Data portability allows individuals to receive and transfer their data, not delete it.
GDPR Right to Erasure
A GDPR data subject right (Article 17) allowing individuals to request deletion of their personal data under certain conditions, also known as the 'right to be forgotten.'
- Applies when data is no longer necessary or consent is withdrawn
- Organizations must comply unless legal obligation requires retention
- Part of the broader set of GDPR data subject rights
Memory trick: Erasure = 'Erase me from the Records'