---
id: KB-TZ-006
url: https://app.codecontract.io/help/traceability-and-compliance/when-someone-asks-you-to-delete-their-data
idioma: en
categoria: trazabilidad
audiencia: administrador
nivel: avanzado
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-TZ-003, KB-GL-013]
citadoPor: [KB-LE-003, KB-TZ-013, KB-NO-023]
---

# When someone asks you to delete their data

_What can be deleted, what must be kept, and why that is not a contradiction._

**Responde a:** an employee asks me to delete their data · right to erasure what do i do · delete a supplier's data · can i delete a signed document

The request arrives and the instinctive reaction is one of two: delete everything quickly, or delete nothing out of fear. Both are wrong. The right answer separates what must be kept from what there was no reason to hold.

## The three categories

| What it is | What to do |
| --- | --- |
| Data you hold with no current reason | Delete it. It is what the request asks for and what you should not have |
| Data with a legal retention obligation | Keep it, and explain why and until when |
| Evidence of a signature or delivery | Keep it while the document has effects |

> [!IMPORTANT]
> A signature is not deleted. This is not a technical limitation: a signature that could be made to disappear at the signer's request would prove nothing, and then no signed document would hold. That gets explained; it is not negotiated.

## What to do, in order

1. **Check who is asking** — That it is the person the data concerns. An erasure request is also an impersonation vector.
2. **Talk to whoever handles data protection** — Someone in your company is responsible for this, even if the title says otherwise. There are deadlines.
3. **Separate the three categories** — With the retention policy in front of you, not from memory.
4. **Reply with reasons** — What was deleted, what is kept and why. A reasoned reply closes nearly every request.

> [!WARNING]
> If there is a live claim or litigation touching that data, delete nothing without checking. Deleting material relevant to open proceedings is a bigger problem than the one you were solving.

> [!NOTE]
> The best way to answer these requests well is not to have kept too much. A retention policy genuinely applied turns this into a ten-minute task.

**Is this legal advice?**

No. It is the practical criterion; the specific deadlines and duties come from your adviser.

**How long do I have to respond?**

There are legal deadlines and they are short. Which is why step one is telling the right person.

**Is my deletion recorded?**

Yes, and that helps: it is what shows you honoured the request.

## Ejemplos

**A former employee asks for all their data to be deleted.**

- The ID copy, held for no reason, is deleted
- Their signed contract and payslips are kept, with their legal period
- They receive a reply explaining both

→ The request closes without conflict, and an identity document that was never needed stops being held.

**A deletion request arrives and nobody knows where everything sits.**

- Locates where that person appears

→ The request is handled without searching everywhere.

**Something is deleted and a copy remains elsewhere.**

- Reviews every location before confirming

→ The deletion is complete.

**Something that had to be retained is deleted.**

- Checks the policy before deleting

→ What can be deleted is told from what cannot.

**There is no record the request was handled.**

- Records the request and what was done

→ The response is demonstrable.

**The request reaches somebody who cannot resolve it.**

- Writes down who handles it

→ The request does not sit waiting.