The European Data Protection Board (EDPB) has launched its 2025 Coordinated Enforcement Framework (CEF) action, focusing on the enforcement of the right to erasure under Article 17 GDPR.
This initiative follows the 2024 action on the right of access and aims to assess how organizations handle requests to delete personal data. The Swedish Authority for Privacy Protection (IMY), alongside 31 other Data Protection Authorities within the EU, will investigate compliance by engaging with data controllers, conducting fact-finding exercises, and carrying out formal audits. The objective is to evaluate how erasure requests are processed, including the application of relevant exceptions.
Throughout 2025, IMY will engage with selected entities to gather insights into their erasure request procedures. The collective findings will be analyzed to support targeted enforcement actions at both national and EU levels.
This coordinated action is part of the EDPB:s 2024–2027 strategy, which aims to strengthen compliance with data protection regulations and enhance cooperation among data protection authorities.
See here for EDPB:s press release.
