Removal of data will be especially challenging for many organisations as databases will have links and dependencies on the customer records. You’ll need to understand what can be achieved and develop clear processes to achieve the required removals. In some cases, this may mean that you have to edit the customer record to remove the identifiable material rather than deleting it
To be clear you do not need to delete data related to a transaction immediately on receiving a request – you have legitimate interest to hold this for a statutory period. However, you must ensure that data can be – and is -deleted after that statutory period expires.
Time to review your data retention rules and processes! Do you dispose of archived data when it is no longer relevant? What about records in document archives and imaging systems? How many generations of system backups are retained and when are they disposed of? All this needs to be looked at alongside ensuring that you have customer facing processes in place to acknowledge a request for data removal and confirm the action you are taking.
A bit of thinking also needs to happen about how you evidence the removal in response to the request. Are you going to retain personally identifiable information in details of the request to be forgotten or anonymise the details? You could argue legitimate interest for these details but doesn’t that defeat the point of the customer request? Without it how can you convince anyone that it was actually done?