{"id":99956,"date":"2025-08-27T16:24:53","date_gmt":"2025-08-27T15:24:53","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=99956"},"modified":"2025-08-27T16:28:40","modified_gmt":"2025-08-27T15:28:40","slug":"does-a-company-have-to-confirm-the-deletion-of-my-personal-data","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/moet-een-bedrijf-het-wissen-van-mijn-persoonsgegevens-bevestigen\/","title":{"rendered":"Does a company have to confirm the deletion of my personal data?"},"content":{"rendered":"

You have requested a company to delete your personal data in accordance with the General Data Protection Regulation (GDPR)<\/a>, but after that it remains deafeningly silent. Even if the company has effectively deleted your data, not responding to your request is a violation. A company is required by law to inform you within one month of the action it has taken in response to your request.<\/p>\n\n\n\n

A decision of the Belgian Data Protection Authority (DPA) of 2 July 2025 (No. 114\/2025<\/a>) underscores this crucial communication duty.<\/p>\n\n\n\n

The facts: a request for erasure without response<\/h2>\n\n\n\n

The case that came before the DPA was simple but very recognizable. A citizen received marketing emails from a company and decided to exercise his rights under the AVG. On 22 November 2024, he submitted a formal request to the company to delete all his personal data and remove him from all mailing lists. <\/p>\n\n\n\n

When there was no response, the man filed a complaint with the Data Protection Authority on 27 December 2024. <\/sup><\/p>\n\n\n\n

In its defense, the company argued that it had indeed deleted the data, in accordance with the request. The reason the applicant was never informed of this was due to \"human error,\" according to the company. <\/sup><\/p>\n\n\n\n

The decision: erasing is not enough, informing is a duty<\/h2>\n\n\n\n

The DPA's Dispute Chamber ruled that despite having deleted the data, the company had still violated the GDPR. <\/p>\n\n\n\n

The crux of the decision lies in Article 12.3 of the GDPR. This article states that a data controller (the company) is obliged to provide the data subject (the citizen) with information on the action taken on the request \"without delay and, in any event, within one month of receipt of the request.\" <\/p>\n\n\n\n

The company had deleted the data, but had failed to notify the applicant of this within the legal deadline. The DPA ruled that this constituted a clear violation of the GDPR and imposed a formal warning on the company. <\/p>\n\n\n\n

Legal analysis and interpretation<\/h2>\n\n\n\n

This decision is an important reminder of the principle of the accountability from Article 5.2 of the GDPR. Not only must an organization comply with the rules of the GDPR, but it must also be able to prove its compliance. The communication obligation from Article 12 is an essential part of that burden of proof.<\/p>\n\n\n\n

The ratio decidendi<\/em> of the DPA is clear: the exercise of the data subject's rights (such as the right to data erasure from Article 17 GDPR) generates an active information obligation for the controller. It is a twofold obligation: (1) perform the action (erase, correct, give access) and (2) inform the data subject about it. The \"human error\" argument is not accepted by the DPA as a valid justification. Indeed, within the GDPR, the data controller is obliged to implement the necessary technical and organizational measures to ensure proper compliance. An isolated error often indicates a structural flaw in the internal procedures.<\/p>\n\n\n\n

What this specifically means<\/h2>\n\n\n\n