# Standards and Regulatory References — Automated Deletion Workflow

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 5(1)(e)** — Storage limitation: data kept no longer than necessary
- **Article 17(1)** — Right to erasure: obligation to erase without undue delay
- **Article 17(2)** — Notification obligation when data made public
- **Article 19** — Notification obligation regarding erasure to recipients
- **Article 25(1)** — Data protection by design: technical measures to implement data protection principles
- **Article 30(1)(f)** — Records of processing: envisaged time limits for erasure
- **Article 32** — Security of processing: includes integrity and availability controls for deletion systems
- **Recital 39** — Time limits for erasure or periodic review
- **Recital 65** — Right to erasure elaboration

### UK Data Protection Act 2018
- **Section 47** — Right to erasure (law enforcement processing)

## Regulatory Guidance

### EDPB (European Data Protection Board)
- **Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases** (adopted 7 July 2020)
- **Guidelines 01/2022 on data subject rights — Right of access** (adopted 28 March 2023) — Relevant interaction between access and erasure

### ICO (UK Information Commissioner's Office)
- **Right to erasure guidance** — Operational requirements for erasure implementation
- **Accountability framework** — Requirement for documented deletion procedures

## Technical Standards
- **NIST SP 800-88 Rev. 1** — Guidelines for Media Sanitization (applicable to technical deletion methods)
- **ISO/IEC 27001:2022 Annex A Control A.8.10** — Information deletion
- **ISO/IEC 27701:2019 Section 7.4.5** — PII de-identification and deletion
- **OWASP Data Protection Guidelines** — Secure deletion practices for web applications