Access, erasure and retention are connected but distinct. Access helps a person understand processing and obtain their personal data. Erasure concerns whether particular data must be deleted. Retention concerns why information remains necessary and for how long. This guide explains the relationship using official EU and French sources checked on 23 October 2026, without deciding an individual dispute.
Identify the controller and the information involved
The European Data Protection Board guidance on individual rights distinguishes the organisation deciding the purposes and means of processing from a processor acting on its instructions. That distinction matters when a service uses an outside host, payment provider or support supplier. Begin with the controller's identity and the relevant processing operation rather than sending an undifferentiated demand to every company mentioned on a website. A request can describe the account, period and categories of information concerned without disclosing unnecessary additional personal details. A useful first question is whether the organisation actually processes your data; a public-facing website address alone does not answer that question.
Access is an explanation and a copy of personal data
The GDPR chapter on individual rights, reproduced by CNIL, sets out access to personal data and information about processing. These are related but separate deliverables: a data export may not explain purposes, recipients, retention criteria or the available rights. Conversely, a generic privacy policy is not necessarily a response about a particular person's data. Access is not automatically an entitlement to every complete business document in which a person's name appears. The rights and freedoms of other people also matter. A careful request identifies the personal data sought and asks for understandable context, while recognising that appropriate redaction or a suitable extract can be relevant.
The response period has conditions
The EDPB describes a response without undue delay and generally within one month. Complexity or the number of requests can justify an extension of two further months, with notice and reasons within the first month. The extension is not an automatic three-month standard for every organisation. Requests are generally free, while manifestly unfounded or excessive requests have specific exceptions. Where reasonable doubts about identity exist, necessary additional information may be requested. This is not a licence to collect unrelated identification documents routinely. Keep a dated copy of the request and any correspondence so that a later assessment can distinguish a justified procedural step from silence or an unexplained refusal.
Erasure is a qualified right
Erasure depends on the legal grounds and circumstances, rather than the wording of a single button. Data that are no longer necessary, unlawfully processed or subject to a valid withdrawal of the relevant consent can raise erasure questions. The GDPR also contains exceptions, including certain legal obligations, freedom of expression, public-health purposes, qualified research or archiving, and legal claims. An organisation should identify the exception relevant to the data it retains; a broad statement that “the law requires everything” is not a precise explanation. Equally, deleting an account does not automatically remove records that must lawfully be kept for a different, documented purpose.
Build a retention explanation by purpose
| Record category | Question to document | Unjustified shortcut |
|---|---|---|
| Active profile information | Is it still needed for the stated service? | Keep everything while storage is cheap |
| Consent evidence | Which compliance purpose and period apply? | Retain all browsing history as proof |
| Dispute-related records | Which claim or legal obligation is relevant? | Every record is permanently protected |
| Research or archive data | Which safeguards and legal conditions apply? | Research is an unrestricted exemption |
The CNIL guidance on retention periods emphasises that periods follow purposes and applicable requirements. The table is a method for asking questions, not a statutory schedule prescribing one duration for every organisation. A record may move from operational use to a restricted archive, but that change needs a reason and appropriate access controls. Merely renaming a database “archive” does not establish necessity.
Deletion, restriction and correction solve different problems
Sometimes the concern is incorrect information; sometimes it is disputed processing; sometimes the information is no longer needed. The appropriate right depends on the situation and legal basis. Correction does not necessarily require destroying the entire account history, and restriction is not simply another name for deletion. The Commission explanation of GDPR principles connects accuracy, purpose limitation, minimisation and storage limitation. These principles help frame the request without assuming that every right applies identically to every legal basis. A focused explanation states what is inaccurate, excessive or no longer justified, and separates that issue from any contractual complaint about the underlying service.
Checklist for a clear rights request
Identify the controller and a verified contact channel; describe the processing and time period; state the right you wish to exercise; provide only the identification information reasonably necessary; retain the request date; and note any response or extension. If asking about retention, request the relevant purpose and period or the criteria used to determine it. If deletion is refused, ask which categories remain and why. This checklist does not guarantee a particular outcome. It makes the issue intelligible and creates a record against which the controller's reasoning can be assessed. Avoid sending passwords, complete payment credentials or unrelated documents as supposed proof of identity.
- Identify the controller and processing operation.
- Record the request and response dates.
- Ask which purpose justifies retained categories.
- Keep unnecessary identity documents out of the request.
Read a refusal before choosing a complaint route
A refusal should explain the reasons and the available supervisory and judicial remedies. Compare that explanation with the actual request rather than treating every partial response as equivalent. Did the controller distinguish data it deleted, data it never held and data retained under a stated exception? Did it explain a lawful limitation or merely refer to a general policy? A data-protection authority addresses compliance with data-protection law; it is not automatically the forum for every refund or contract dispute. Where several issues coexist, keep the personal-data question separate so that each institution receives facts relevant to its role. This page does not determine which authority has jurisdiction in a specific cross-border case.
Frequently asked questions
Does closing an account erase every record?
Not necessarily. Different records can have distinct lawful purposes and retention requirements; the controller should explain the categories and reasons.
Can every organisation take three months to answer?
No. The normal period is one month; a justified extension requires notice and reasons within that first month.
Is a privacy policy the same as an access response?
No. A policy describes general processing; an access response concerns the requester’s personal data and the relevant processing information.
Sources and verification
- Handling individual rights requests — European Data Protection Board — 2026-10-23
- GDPR Chapter III: rights of the data subject — CNIL / EU legislative text — 2026-10-23
- Determining personal-data retention periods — CNIL — 2026-10-23
- Principles of personal-data processing — European Commission — 2026-10-23