How to Handle a Right to be Forgotten Request on Your Forum
Community administrators frequently face privacy questions from registered users who want their accounts removed. As covered in our guide on privacy basics for forum owners, the European Union General Data Protection Regulation establishes enforceable rights regarding personal data. Among these provisions is the right to erasure, commonly referred to as the right to be forgotten. Originating from precedent established in a 2014 judgment from the EU Court of Justice and codified in Recitals 65 and 66 alongside Article 17 of the GDPR, this standard requires data controllers to remove personal data under specific conditions. Establishing a formal workflow helps forum teams review incoming requests, confirm identities, and respond in compliance with the law.
Step One: Identify and Log the Erasure Request
The first challenge for forum administrators is simply recognizing when an erasure request has occurred. Under the GDPR, there is no rigid format that an individual must follow. A member can submit a request verbally or in writing. Furthermore, a valid request does not have to be sent to a designated privacy contact or site administrator; it can be directed to any member of your organization. This means volunteer moderators or support staff might receive an inquiry during routine forum discussions. If you coordinate your team using a forum moderation guide, ensure all team members understand how to route these inquiries to the administrator desk.
Moreover, an inquiry remains completely valid even if the member never cites Article 17, the GDPR, or the phrases "Right to be Forgotten" or "Request for Erasure." As detailed by GDPR.eu's guide to the Right to be forgotten, as long as the user communicates a desire to have their data erased and meets the regulation's criteria, the controller must treat it as an active request. Once identified, log the date of receipt immediately to begin tracking your response timeline.
Step Two: Verify the Requester's Identity
Before deleting any database records or personal information, controllers must take reasonable steps to verify that the person requesting erasure is actually the data subject. Erasing data belonging to the wrong user can lead to significant administrative and operational problems. To confirm identity, an administrator can ask the applicant to provide supporting documentation.
Acceptable verification documents include:
- Proof of identity: Copies of a photo driver's license, passport, birth certificate, or national identity card.
- Proof of address: A valid driver's license, or paperwork such as a bank statement, utility bill, or credit card statement that is no more than 3 months old.
- Third-party authority: If someone submits a request on behalf of a data subject, they must supply written authority from the subject, along with identity verification for both the subject and the representative.
If you cannot verify the applicant's identity after reviewing their materials, you reserve the right to refuse the deletion request.
Step Three: Evaluate the Lawful Grounds for Erasure
The right to erasure is closely linked to the right of access in Article 15, allowing users to take action when data is retained unnecessarily or without valid consent. However, Article 17 requires specific criteria to be met before a controller must erase personal data. You must review the request against the following lawful grounds:
- The user records are no longer needed for the specific purposes for which your community originally gathered or processed them.
- Your community relied on consent as the lawful basis for data processing, and the user formally withdraws that consent.
- You relied on legitimate interests to justify processing, the member objects, and your forum has no overriding legitimate interest to continue processing.
- The personal data was processed for direct marketing activities and the member objects.
- The user's personal data was processed unlawfully.
- The data must be erased to satisfy a legal obligation or legal ruling.
- The data was processed to offer information society services to a child.
Step Four: Assess Legal Overrides and Exceptions
The right to be forgotten is not an absolute entitlement. If it were absolute, it would risk rewriting history across online platforms. The GDPR balances individual privacy against broader legal and societal interests. According to GDPR.eu, an organization's right to process personal data overrides the right to erasure under several conditions:
- The records are actively needed to exercise the right to freedom of expression and information.
- Processing is required to comply with a legal obligation or legal ruling.
- The data is needed to perform a task carried out in the public interest or in the exercise of official authority.
- Processing serves public health purposes in the public interest.
- The information is necessary for preventative or occupational medicine handled by a health professional bound by professional secrecy.
- The data serves significant public interest, scientific research, historical research, or statistical goals, and deleting it would impair or halt progress toward that objective.
- The data is required for the establishment of a legal defense or the exercise of other legal claims.
In addition, under Article 12(5) of the GDPR, an organization may charge a reasonable fee or deny the request outright if it can demonstrate that the submission is manifestly unfounded or excessive.
Step Five: Execute the Erasure Without Undue Delay
When an erasure request is verified and satisfies the lawful conditions without being blocked by an override, the forum controller must delete the personal data without undue delay. The GDPR considers undue delay to be about a month. In practice, you should respond promptly, and in any event within one month from receiving the written request or within one month of receiving any supplementary information requested to clarify the application, whichever date is later.
If you determine that an exception applies under Article 17, or if you refuse the application as unfounded or excessive under Article 12(5), you must inform the applicant promptly and provide clear reasons explaining your decision.
Sources
This setup guide references requirements and guidance from the following resource:
Published October 28, 2026. No affiliate links on this page. Facts come from the sources linked above; check them for updates.