Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Article 17 of UK GDPR gives individuals a “right to erasure” — often called the right to be forgotten — that is legally distinct from the right of access dealt with by a Subject Access Request. An erasure request can be made whenever personal data is no longer necessary for the purpose it was collected for, when someone withdraws consent and no other lawful basis applies, when they object to processing and there are no overriding legitimate grounds, when data has been processed unlawfully, or where data about a child was collected for an online service. As with SARs, businesses normally have one calendar month to respond, extendable by two months for complex requests, and the Data (Use and Access) Act 2025 confirmed the same “stop the clock” pause while a business waits on clarification from the requester.
The right is not absolute — it can be refused where processing is necessary for freedom of expression, compliance with a legal obligation, public interest tasks, public health, archiving or research purposes, or the establishment of legal claims — but a blanket refusal without considering these grounds is itself a breach. Many small and medium UK businesses conflate erasure requests with SARs, or only delete data from their main customer database while leaving copies in backups, marketing platforms, spreadsheets, or with third-party processors. Article 17(2) also requires businesses that have made personal data public to take reasonable steps to tell other controllers processing it that erasure has been requested. The ICO treats mishandled erasure requests as an enforceable complaint in their own right, so having a documented, tested process for finding and removing personal data across every system it lives in matters as much as answering the request on time.
