12.
(1) Pursuant to section 40 (1) (b) of the Act, a data subject may, request a data controller or data processor to erase or destroy personal data held by the data controller or data processor where —
(a) the personal data is no longer necessary for the purpose which it was collected;
(b) the data subject withdraws their consent that was the lawful basis for retaining the personal data;
(c) the data subject objects to the processing of their data and there is no overriding legitimate interest to continue the processing;
(d) the processing of personal data is for direct marketing purposes and the individual objects to that processing;
(e) the processing of personal data is unlawful including in breach of the lawfulness requirement; or
(f) the erasure is necessary to comply with a legal obligation.
(2) A data subject may request for erasure of their personal data held by a data controller or data processor in Form DPG5 set out in the First Schedule.
(3) A data controller or data processor shall respond to a request for erasure under sub-regulation (2) within fourteen days of the request.
(4) A right of erasure does not apply if processing is necessary for one of the following reasons—
(a) to exercise the right of freedom of expression and information;
(b) to comply with a legal obligation;
(c) for the performance of a task carried out in the public interest or in the exercise of official authority;
(d) for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing; or
(e) for the establishment, exercise or defence of a legal claim.
(5) A request for erasure shall be free of charge.
