The data subject has the right to request the data controller in writing or electronically for erasure of his or her personal data where:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or processed;
2. the data subject withdraws consent on which the personal data processing is based and where there is no other legal ground for the processing;
3. the data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing;
4. the personal data have been unlawfully processed.

The data controller who has disclosed personal data to a third party or has posted the personal data in the public domain must, in writing or electronically, inform a third party processing such data that the data subject has requested the erasure of any links to, or copy of, those personal data.

However, the right to request the erasure of personal data does not apply to the extent that processing is necessary:

1. for reasons of public interest;
2. for historical or scientific research purposes or statistical purposes;
3. for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
4. for the establishment, exercise or defence of legal claims in the interest of the data controller.

The data controller, within thirty (30) days from the date of receipt of the request, must inform the concerned data subject in writing or electronically of the erasure of his or her personal data.

The data subject who is not satisfied with the response of the data controller may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.