The controller must erase personal data without undue delay where they are no longer needed, consent is withdrawn and no other basis exists, the data subject objects under Article 21(1) with no overriding grounds or objects to direct marketing, the processing was unlawful, erasure is required by domestic law, the data were collected for information society services offered to a child, or (in England and Wales from 31 March 2026, and in Scotland and Northern Ireland by extension under the Data (Use and Access) Act 2025) the data were processed because of an allegation made by a malicious person (someone convicted of specified harassment or stalking offences against the data subject or subject to a stalking protection order) that the controller investigated and decided to take no further action on. A controller that made the data public must take reasonable steps to tell other controllers of the erasure request. Exceptions cover freedom of expression, legal obligations and public tasks, public health, archiving, research and statistics under Article 84B where erasure would seriously impair them, and legal claims.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.