ARCHETYPAL

Erase personal data when required

AIR-04A480E942 · version 2 · Privacy · candidate interpretation

Data controllers must erase personal data when required.

Situation & purpose

An AI system or employee activity involves personal data when required. Confirm the actor and source conditions before using this template.

Provide a traceable control for the action: erase personal data when required.

Examples

Meets the rule
Data controllers performs the required action "erase" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.
Does not meet the rule
Data controllers omits the required action "erase" for personal data when required while those source conditions apply.
Outside scope
The actor, activity, jurisdiction, or applicability conditions in this source variant do not match.

Evidence & enforcement

  • Dated record of the action
  • Responsible actor and approval, where required
  • Applicable source edition and scope

Human or authorized system adapter required. Machine-executable: no. Convert to a reviewed organization contract and validate the adapter before deployment.

Limits

A rule card is an interpretation aid, not an applicability determination.

Equivalent intent does not make different source obligations interchangeable.

Owner review

Record your interpretation decision. This does not adopt a policy for an organization.

Owner sign-in

JSON rule card
{
  "id": "AIR-04A480E942",
  "version": 2,
  "title": "Erase personal data when required",
  "text": "Data controllers must erase personal data when required.",
  "topic": "Privacy",
  "intent": "erase personal data when required",
  "status": "candidate",
  "semanticStatus": "human-validation-required",
  "variants": [
    {
      "sourceId": "eu-gdpr",
      "control": "Article 17(1)",
      "sourceVersion": "Regulation 2016/679",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
      "actor": "Data controllers",
      "modality": "must",
      "action": "erase",
      "object": "personal data when required",
      "condition": "Subject to statutory exceptions",
      "exception": "See article-specific exceptions and safeguards",
      "timing": null,
      "authority": "binding-within-scope",
      "jurisdiction": "European Union",
      "checkedAt": "2026-10-03",
      "status": "interpretation-needs-review",
      "examples": {
        "meetsRule": "Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.",
        "doesNotMeetRule": "Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.",
        "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
      }
    }
  ],
  "situation": "An AI system or employee activity involves personal data when required. Confirm the actor and source conditions before using this template.",
  "purpose": "Provide a traceable control for the action: erase personal data when required.",
  "examples": {
    "meetsRule": "Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.",
    "doesNotMeetRule": "Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.",
    "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
  },
  "evidence": [
    "Dated record of the action",
    "Responsible actor and approval, where required",
    "Applicable source edition and scope"
  ],
  "enforcement": {
    "mode": "policy-template",
    "adapter": "Human or authorized system adapter required",
    "machineExecutable": false
  },
  "limitations": [
    "A rule card is an interpretation aid, not an applicability determination.",
    "Equivalent intent does not make different source obligations interchangeable."
  ],
  "createdAt": "2026-10-03",
  "updatedAt": "2026-10-03"
}
Back to registry