What is the best practice when a client requests deletion of their data?

• A. Verify identity, remove data, and document the deletion in accordance with GDPR.
• B. Immediately delete all data without verification.
• C. Archive data for possible future requests.
• D. Notify the client after 30 days and then delete.

Answer: (A)

When a client requests data deletion, the best practice is to verify their identity, remove the data, and document the deletion in line with GDPR. Verifying identity is essential to prevent someone else from impersonating the client and triggering deletion of data they shouldn’t control. Deleting the data means removing it from all systems where personal information is processed, so it can’t be used or accessed, rather than leaving it archived in place. Documenting the deletion creates an audit trail that shows what was removed, when, and by whom, which supports accountability and demonstrates compliance if questioned later. This approach aligns with GDPR rights of individuals and the requirement for clear, auditable processes for data processing and erasure.