What You Are Owed, and How Intrudly Gets It

Article 17 of the General Data Protection Regulation gives you the right to erasure, often called the right to be forgotten. A company holding personal data about you has to delete it when you ask if, for example:

• It no longer needs the data for the purpose it collected it for.
• It relied on your consent, and you withdraw that consent.
• You object to how it uses your data, including for direct marketing.
• It has been processing your data unlawfully.

The company must respond within one month of receiving the request. For complex requests, or a large number of them, it can extend that by up to two further months, but it has to tell you so, and why, within the first month. Intrudly tracks a 30-day deadline from the day the request is sent and flags anything that runs past it.

When a company can say no

• The law requires it to keep the data, such as invoices kept under tax and accounting rules.
• It needs the data to establish, exercise, or defend a legal claim.
• Keeping it is necessary for freedom of expression and information, such as journalism.
• It is needed for public health, or for archiving, research, or statistics in the public interest.

A company that refuses, or keeps part of your data, has to tell you why within the same month, and let you know that you can complain to a data protection authority.

You name a company, or pick a breach Intrudly found for one of your monitored addresses. You tell us which email address the request is about and, if you like, the name you used with that company, which helps it find the right record. Intrudly then finds the company's data protection contact, or its general contact address if it does not publish one.

The request is an Article 17 erasure request, sent by Intrudly on your behalf. It names you as the person the data is about and makes clear that Intrudly is acting on your instruction. Nothing goes out unless you ask for it, and each request covers one company you chose.

Some companies ask for proof of identity before acting on a request sent on someone's behalf, which the GDPR allows when they have reasonable doubts about who is asking. If one does, we will get in touch with you.

From there, Intrudly tracks the 30-day deadline and follows up with any company that misses it. Your Requests page shows every request with its deadline and where it stands: awaiting a reply, overdue, erased, or refused.

If a company misses its deadline and still does not answer after a follow-up, or refuses without a valid reason, you can complain to a data protection authority. You can go to the authority in the EU or EEA country where you live, where you work, or where the problem happened.

When a request reaches this point, Intrudly helps you prepare the complaint: the request itself, the timeline, and the company's reply or silence. The complaint is yours. You decide whether to send it, and what happens next is up to the authority.

Erasure is not always total, and a company that keeps something is not necessarily refusing your request. The most common lawful reasons are:

• Invoices and transaction records kept for tax and accounting law, often for five to ten years depending on the country.
• A short “do not contact” record, so the company can keep honouring your wish not to hear from it.
• Data tied to an ongoing legal dispute or investigation.
• Backups, which are usually overwritten on their own schedule rather than edited on request. Until then, the company should not use them.

A company that keeps something should tell you what it kept and why. Your Requests page shows which companies have confirmed erasure and which have refused, so you can see where each one stands.