InackGuardWho this guide is for
This guide is for privacy, compliance and operations teams at businesses that screen customers, vendors or other counterparties and also receive data-protection requests. It explains how erasure rights interact with record-keeping duties, the steps to handle a request, the difference between deleting and anonymising, edge cases that come up in screening, and a template reply. It is general information, not legal advice: the right answer depends on your law, your obligations and the specific facts, so take advice where you are unsure.
The tension
Privacy law gives people the right, in many cases, to ask you to erase their personal data. Anti-money-laundering and sanctions rules often require you to keep due-diligence records for years. Both can apply to the same person.
Step 1: Verify and log the request
Confirm the requester's identity, record the date of the request and acknowledge it within the time your law requires.
Step 2: Decide what must be kept
Records you are legally required to keep, such as customer due-diligence and screening records for the retention period, can usually be retained, with access restricted. Check your own obligations and, where unsure, take advice.
Step 3: Erase or anonymise the rest
Delete or anonymise personal data you no longer need: marketing data, unopened previews, documents kept only for convenience. Where records must stay linked for integrity, anonymising the personal fields can be better than deletion.
Step 4: Respect legal holds
If a dispute, investigation or regulatory request is open, a legal hold may require you to keep data. Record the hold and its reason, and tell the requester what you can.
Step 5: Respond and record
Tell the person what you erased, what you kept and why, and how to complain. Keep a log of the request and your response.
A worked example
A former applicant asks a payments firm to erase their data. The firm verifies their identity and checks its records: the applicant was screened but never became a customer. The firm keeps the screening record for the period its rules require, restricted to the compliance team, deletes the marketing data and the unopened preview, anonymises the applicant's personal fields in analytics, and writes back within the deadline explaining what was deleted, what was kept, why, and how to complain.
Common mistakes
Checklist
A deeper look: what counts as personal data here
In a screening context, personal data includes the names, dates of birth, addresses and identifiers you entered, the results that relate to a person, adverse-media items about them and any notes your reviewers wrote. Business data about a company can also include personal data about its directors and owners.
A deeper look: anonymisation versus deletion
Deleting a record can break links that other records depend on, such as an evidence chain. Anonymising replaces the personal fields with neutral values while keeping the structure, so integrity checks still work and nothing identifies the person. Use deletion where nothing depends on the record, and anonymisation where it does.
Questions people ask
Do we have to tell the person they were screened? Privacy notices should explain that you screen customers and counterparties. Specific disclosures depend on your law and must never tip off the subject of a suspicious-activity report.
What about data our vendors hold? Pass the request to processors acting for you, and record that you did.
What if the person was a confirmed match? Retention duties and legal holds are more likely to apply. Take advice and record the basis for keeping data.
How long do we have to reply? Many privacy laws set a deadline of about a month, sometimes extendable for complex requests, but check the rule that applies to you. Start the clock on the day you receive the request, not the day it reaches the right person, and build in time for checking retention duties, legal holds and the vendors who process data for you.
Making it routine
Write a short procedure, assign an owner, use a template response, and log every request. Review the log quarterly to check deadlines were met and decisions were consistent.
A response template
A clear reply avoids follow-up questions. A simple structure:
Keep a copy of the reply with the request log. Use the same template for every request so responses are consistent and quick to prepare.
When your vendors process data for you, include them: send them the request, confirm what they deleted, and keep their confirmation with your log.
Common edge cases
The person is a former employee of a business customer: their data may be part of the business's due-diligence file, so retention duties can still apply. The person was screened but never contacted you directly: verify carefully and explain how their data came to you. The person asks for erasure while a suspicious-activity report is open: take advice before replying, and do not reveal the report.
Key terms
Summary
Erasure requests sit where privacy rights meet record-keeping duties. Verify the request, separate what the law requires you to keep from what you no longer need, and erase or anonymise the rest, using anonymisation where other records depend on the data. Respect legal holds, never tip off the subject of a suspicious-activity report, and include the vendors who process data for you. Reply in plain language within the deadline, explaining what you erased, what you kept, why and for how long, and how to complain. Log every request and reply, and review the log regularly for timeliness and consistency. Handled this way, erasure requests become routine administration rather than a legal worry, and your privacy notice and your practice tell the same story.