GDPR gives you one month to answer a deletion request, even if the data is already deleted

In 2024 a French IT consultancy called EXTIA received 265 requests to delete personal data. Most came from people who had applied for a job there. Twelve of those requests were never acted on. A further 166 people were never told what had happened to theirs.

On 21 July 2026 the CNIL, France's data protection authority, fined the company 300,000 euros 2. The decision was published on 9 September.

If that reads as somebody else's problem, look at who was doing the asking. Job applicants. Every software company has the same surfaces: a careers page collecting CVs, a marketing list people unsubscribe from and then want erased, a free tier full of accounts nobody pays for. Those are the places where the company is the one who has to answer, whatever it sells.

What makes the case worth reading is which of the two failures reached more people. Twelve unprocessed requests is a small number. The second finding covers 166 people who were simply never written back to. EXTIA's own defence was that many of them were candidates whose records had been deleted automatically in any case, and the CNIL held that this changed nothing 2. Article 12(3) of the GDPR gives a controller one month to tell a person what it did about their request 1, and a deletion that happens quietly does not satisfy it.

I think this is the 2026 decision I would most want a small team to read. Nobody has to choose to ignore a request. It is enough that nobody owns the reply.

What did EXTIA get wrong?

Two findings, under two different articles. Article 17 is the right to have your data erased. Article 12 is everything about how the request gets handled and what the person is owed afterwards.

The first finding, taken under Articles 12 and 17 together, is that twelve of the 265 requests received in 2024 were never processed at all 2. The second, under Article 12 alone, is the failure to inform, and it reaches far more people: 166 were never told what had happened to their request, and another 27 were told outside the one-month deadline, with delays running to several months 2.

EXTIA lost on both. Almost all of the harm sits in the second.

Why was automatic deletion not a defence?

Because deleting the data and answering the person are two separate obligations, and only one of them can be automated.

EXTIA argued that the breach was less serious than it looked, because a large number of the requests came from candidates whose data had been deleted automatically in any case. The restricted committee, the panel inside the CNIL that decides sanctions, agreed the data was gone and said it made no difference. Automatic deletion did not relieve the company of its duty to inform those candidates of the outcome of their request 2.

Most software teams already have the first half of this built. A scheduled job clears records once a retention period expires, and it runs whether or not anyone asked. What that job cannot do is notice that a particular person wrote in. The clock in Article 12(3) starts when the request arrives, not when the record ages out 1, so a pipeline keyed to the age of a row will never line up with a duty keyed to the date of an email.

The committee did allow for genuine impossibility, accepting that for a residual number of requests the company could not identify the person to inform them 2. Article 12(2) says the same: a controller may decline to act only where it demonstrates it cannot identify the person 1.

What does Article 12 require once a request arrives?

Five obligations, and the deadline is where most teams come unstuck.

• Answer within one month of receipt. Article 12(3) requires the controller to provide information on the action taken without undue delay and in any event within one month 1. The month runs from receipt, not from the day the ticket gets picked up.
• Extend only by telling the person. The month may be extended by two further months where necessary, taking into account the complexity and number of requests. The extension is not automatic: the controller has to inform the person of it within the first month, together with the reasons for the delay 1.
• A refusal is still an answer, and it has a required shape. Under Article 12(4), a controller that takes no action must still respond within one month, give the reasons, and tell the person they can lodge a complaint with a supervisory authority and seek a judicial remedy 1. Most refusals leave that last element out.
• Erasure is not absolute. Article 17(1) sets out the grounds on which a person can demand deletion, among them that the data is no longer necessary for the purpose it was collected for, and that consent has been withdrawn with no other legal ground available. Article 17(3) lists five situations where those grounds do not apply, and two of them cover most commercial cases: compliance with a legal obligation, and the establishment, exercise or defence of legal claims 1. Keeping invoices for the period your tax law demands is a refusal you can make in writing.
• Pass the erasure on. Article 19 requires the controller to communicate an erasure to each recipient the data was disclosed to, unless that proves impossible or involves disproportionate effort, and to tell the person who those recipients are if they ask 1. Most vendors in a SaaS stack are processors acting on your documented instructions, so deletion should already travel to them through your data processing agreement. Article 19 earns its keep for everyone else you handed data to: a reseller, a partner, an enrichment provider, an analytics vendor operating as its own controller.

What did Europe's regulators find when they checked 764 companies?

That compliance is "average", and that the gaps are mostly not about whether companies delete. The European Data Protection Board (EDPB), where the EU's national privacy regulators coordinate, runs one joint enforcement exercise a year, and for 2025 it picked the right to erasure. 32 supervisory authorities took part and 764 controllers answered a common questionnaire, with the report adopted on 10 February 2026 3. EXTIA's April 2025 audit was carried out in that context 2.

Seven recurring issues are named. Three of them are engineering problems:

• No written procedure. Seventeen authorities raised controllers having no internal procedure for handling erasure requests at all, or one that was incomplete or irregularly reviewed 3. The report notes that this confirms a conclusion from the EDPB's 2024 coordinated action on the right of access, where the same gap showed up 3.
• Retention periods nobody has settled. Authorities found inconsistent practice and real difficulty among controllers in defining retention periods at all 3. You cannot say what you delete on request if you have not decided what you delete on schedule.
• Backups. Half the responding authorities raised concerns. Many controllers had no procedure specific to erasure in backups and leaned on automatic measures not tied to any request, and one authority found deletion spread over such long increments that it could not establish whether erasure was happening "without undue delay" as Article 17(1) requires 3.

The number I keep thinking about is quieter than the headline ones. About 70% of the controllers surveyed receive fewer than ten erasure requests a year, and most of those asked had not had a single one in the previous two years 3. The report draws the conclusion out loud: small controllers receiving zero or a negligible number of requests are unlikely to have anything in place 3. A process exercised eight times a year rarely gets written down, so it lives in one person's head until that person leaves.

The CNIL has since ordered two of the six organisations it audited to bring themselves into compliance, and the 2026 edition of the exercise has moved on to what you tell people in the first place, under Articles 12, 13 and 14.

What should you do if your product stores personal data?

All of this is about the data you collected yourself. Where you hold data on behalf of a business customer, their end users send their deletion requests to that customer, not to you. And all of it has to exist before the request arrives, because the month starts on the day it does.

Find out where a deletion request would land today. In most small companies the honest answer is a shared support inbox, a privacy@ alias nobody owns, or a form that files a ticket into the same queue as bug reports. Send one yourself, from an address the company does not recognise, and watch what happens to it. If I had to pick one of these to do first, it would be this one.

Decide the answers in advance rather than per request. Which categories of data you delete on request, which you keep, and for each thing you keep, which Article 17(3) ground or legal retention obligation you are relying on. Written down once, that list is also what makes a refusal defensible, since a refusal has to carry its reasons.

Draft the three replies you will need: granted; refused, with reasons and the complaint and judicial routes spelled out; and extended, with the reason for the delay.

Make your automated deletion visible to whoever writes those replies. If a retention job has already cleared the account, that is a good thing to say in the reply. It is not a substitute for sending one.

Be honest about backups. If you genuinely cannot remove one person's rows from a snapshot, say what happens when that snapshot is restored, and keep a record of outstanding requests to reapply against it. The EDPB report treats the absence of any procedure as the failing, not the technical limitation itself 3.

None of that is difficult, and none of it is only for companies the size of EXTIA. EXTIA was also not fined for a first mistake: two earlier reminders of its obligations are among the reasons the committee gave for the amount, so a small team sending one late reply is not facing that number. The duty is identical, though, and by the EDPB's own reckoning the teams least likely to have any process are the ones getting the fewest requests.

Last, read what your own privacy policy says about all of this: the retention periods you publish, and the instructions you give people for exercising the right. Both are claims about a product that keeps changing, and both go out of date quietly when a retention window moves or a new vendor joins the stack. Lawcel, the product we build, watches a team's code changes and tickets for that kind of drift and proposes the document edit. Answering the request in your inbox is a different job, and it is yours.

If you hold personal data about people, you owe each of them a written answer within a month of their asking for it back, or the silence itself is the breach. EXTIA deleted the data, and it still cost 300,000 euros.