For a deletion request, also known as the right to be forgotten, the GDPR provides a period of one month. That month begins to run when you receive the request, not when you recognize it as an official GDPR request. If a request is complicated, or if you receive many requests at once in a short time, you may extend the period by two months. You must inform the data subject of this extension within the first month, with the reason for the delay.
In practice, one month feels shorter than it is. A deletion request often does not arrive as a formal document, but as an email, a phone call, or a message through the contact form on the website. By the time someone in the organization recognizes it as a GDPR request and passes it on to the right person, time has already elapsed that does not count toward the deadline.
What starts the clock
The deadline begins at the moment of receipt, regardless of which channel the request comes through. That means a request that reaches the customer service team, a salesperson, or a receptionist starts the clock just as much as a request that goes directly to the management or HR department. Many companies only discover afterward that a message that sat in an inbox for three weeks was simply a deletion request. To limit that risk, it is wise to clarify within the organization how such a message is recognized and where it should go immediately.
Where the deadline breaks down in practice
Most delays do not arise from the decision to delete, but from finding all the places where the data is stored. A name and email address can appear simultaneously in a CRM system, a billing package, a mailing list, a backup, and with an external party that processes data for you, such as an accountant or a marketing tool. All these locations must be checked, and for each processor that handles data on your behalf, you must verify whether and how they carry out the deletion. An overview of which tools contain which data saves a lot of search work in that process. In the knowledge base it is explained per situation what the GDPR requires of you and where that is based on.
A second source of delay is the question of whether deletion is even applicable. Not every request automatically leads to deletion. Data that you must retain on the basis of a legal obligation, such as certain parts of financial records or personnel files within a statutory retention period, fall outside the deletion obligation as long as that obligation applies. Data that is necessary for the establishment, exercise or substantiation of a legal claim can also be an exception. Which exception applies in a concrete case is for the organisation itself to assess, possibly with a lawyer, and in case of doubt the Dutch Data Protection Authority can provide further clarity on this.
When extension is permitted, and when it is not
The extension of two months is not an automatic mechanism that you can simply invoke. The GDPR links this possibility to the complexity of the request or to the number of requests you must handle at the same time. A single, simple request to remove an address from a mailing list is unlikely to be complex enough to take three months. A request where data is spread across multiple systems and multiple years can be. It is important that you inform the data subject within the first month that you are extending and why; if you do not do so, the original one-month period simply continues.
In practice: keeping the deadline manageable
Most delays can be prevented by knowing in advance where data is stored, rather than having to search for it again with each request. A permanent overview of the systems used, who processes which data in them, and what agreements exist with external parties makes the difference between a request handled within a week and one that takes the full month. Anyone who keeps that overview up to date with a system that monitors the deadline itself no longer needs to rely on the calendar. More about how this approach works in practice, and where the information is based, can be found on the page that explains where the information comes from.
Deletion requests rarely come at a fixed time, and precisely for that reason it is easy to let the first days of the deadline pass unused. Anyone who wants the deadline to start running as soon as a request arrives can set that up via a business account. For similar questions about data subject requests there is also an overview with shorter answers.
Are you unsure whether a specific request that comes to you falls under the deletion obligation, or which exception might apply? That is an assessment that differs per situation, and you would best discuss it with a lawyer or with the Dutch Data Protection Authority. Do you want to quickly see where you stand first? Then you can do the free quick-scan or go through the topics in the knowledge base.