- Technical differentiation between simple file deletion and secure deletion by overwriting.
- Legal framework of the right to erasure and to be forgotten based on the General Data Protection Regulation (GDPR).
- Importance of certifications and physical erasure to prevent the recovery of sensitive data.
Today, privacy has become a fundamental pillar of our digital lives. With the enormous amount of information we move online, it's normal to worry about who has our data and what they use it for, especially when we no longer have a relationship with a company or service.
Having control over our digital footprint is not just a matter of peace of mind, but a recognized right. Therefore, fully understanding what the permanent deletion of information entails and how to do it correctly is vital to prevent our private lives from ending up in the hands of cybercriminals or in third-party databases.
The right to erasure of data and the GDPR
When we talk about data deletion, we are referring to the legal and technical process by which an organization permanently removes a person's information from its systems. In Europe, the General Data Protection Regulation (GDPR), specifically Article 17, provides the legal basis for demanding that our data not be stored longer than strictly necessary.
This right can be exercised in very specific situations, such as when the data is no longer necessary for the purpose for which it was collected, if the user decides to withdraw their consent, or if it is discovered that the processing of said information has been unlawful. However, it is important to understand that this is not an absolute right; a company can refuse if it must comply with a current legal obligation or to protect freedom of expression.
Why you should request that your information be deleted
Sometimes we're too lazy to complete the process, but leaving a trace on any server is a risk. One of the main reasons is to prevent your data from being sold to third parties without your permission, something very common in aggressive marketing. Furthermore, if the company suffers a hack, if your data has already been deleted, there will be nothing to steal , protecting you from potential fraud.
It's also the best way to stop receiving that endless spam of emails and phone calls that are so annoying. Basically, it involves severing all digital ties with an entity once the contract or relationship has ended, ensuring that not a single file remains associated with your identity.
Practical steps to exercise the right to erasure
If you've decided to take this step, the first thing to do is locate the company . Sending just any message won't do; look in the privacy policy or legal notice for the contact information of the Data Protection Officer (DPO). Once you've identified them, check if they have a specific deletion form , as this greatly speeds up the process.
Before drafting your request, it's essential to compile a list of the information they have about you . Review your user accounts, search through old emails, and look for any customer numbers. With this information, write a formal and clear email requesting the cancellation of your service. Once sent, you can expect a response within approximately 30 calendar days.
If the company is stubborn and refuses without giving a valid legal reason, or simply ignores you, you have several options. You can send a firm reminder or, if nothing works, file a complaint with the Spanish Data Protection Agency (AEPD) in Spain, or seek specialized legal advice.
Deletion versus erasure: they are not the same
This is where many people go wrong. Confusing "delete" with "erase" can be a catastrophic security mistake. When we press the delete button or empty the recycle bin, the operating system simply removes the reference index to the file, but the data remains, hidden. Any basic file recovery software on your PC could retrieve it in no time.
Secure erase , on the other hand, involves overwriting the original information with random data patterns. This makes it technically impossible to recover the previous content. Similarly, formatting a disk is not a true security measure, as it only prepares the drive for a new file system, leaving the previous information available to anyone who knows where to look.
Advanced data destruction methods
For companies handling massive volumes of corporate, employee, or customer data (PII), DIY methods are ineffective. Certified data erasure software is the ideal solution for IT assets that will be reused or resold, as it guarantees complete sanitization of the drive.
When a device is beyond repair or confidentiality is paramount, degaussers come into play , using powerful electromagnetic fields to annihilate the data in seconds. And if we want to be absolutely certain, physical shredders reduce the hardware to minuscule pieces, eliminating any possibility of information recovery.
Certifications and regulatory compliance
In highly regulated sectors, simply stating that data has been erased is insufficient; proof is required. This is where tamper-proof data erasure certificates come in . Following a government standard is not the same as possessing an official certification that validates the process in the event of an audit.
International regulations and schemes such as the ENS (National Security Scheme ) and certifications like R2 and e-Stewards ensure that electronic recycling is carried out responsibly and securely. Hiring an authorized agent guarantees that the chain of custody is protected and the law is strictly followed , from collection to final destruction .
Proper information management, whether through exercising legal rights or using physical and digital destruction tools, is the only real way to prevent leaks. Ensuring that data has been overwritten or physically destroyed allows hardware to be reused safely, closing the loop on security and sustainability.
