European data protection authorities (DPAs) have identified seven recurring challenges in implementing the “right to be forgotten” – formally known as the right to erasure – across the European Union, according to a report released February 18, 2026, by the European Data Protection Board (EDPB). The findings stem from the EDPB’s 2025 Coordinated Enforcement Framework (CEF) action, which focused on enforcement of Article 17 of the General Data Protection Regulation (GDPR).
The CEF action, which began in 2020, involved 32 member state DPAs and elicited responses from 764 European data controllers. Nine DPAs initiated formal investigations or continued ongoing ones, while 23 conducted fact-finding exercises. The EDPB report indicates that issues encountered mirror those identified in the 2024 CEF work on the right of access.
Among the challenges identified, data controllers often lack “appropriate internal procedures to handle requests, or the lack of sufficient information provided to individuals,” the report states. DPAs also found controllers struggling to assess and apply the conditions for exercising the right to erasure, particularly when balancing it against other rights and freedoms.
The report further highlights concerns over the use of anonymization as a substitute for deletion. “Participating DPAs reported specific findings related to the reliance by some controllers on inefficient anonymisation techniques to handle erasure requests as an alternative to deletion,” the EDPB stated. Difficulties were also noted in determining appropriate data retention periods and ensuring deletion from backup files.
Several DPAs have already issued follow-up guidance. France’s Commission nationale de l’informatique et des libertés (CNIL) issued two formal notices in 2025 as part of the CEF work, potentially leading to penalties. The CNIL’s guidance emphasized that an organization’s size and sector significantly influence its ability to comply with deletion requests, with larger organizations generally receiving more requests and possessing more formalized procedures.
Finland’s Office of the Data Protection Ombudsman sent a voluntary questionnaire to 61 organizations, receiving 37 responses, and subsequently published supplemental guidance on best practices for implementing the right to erasure. The Hellenic Data Protection Authority, after surveying 35 data controllers, found that some replaced deletion with anonymization without sufficient safeguards, struggled with exceptions to the right to erasure, and failed to consistently delete data from backup files. Despite these findings, the Greek DPA reported a “high” level of overall compliance.
Sweden’s Integritetsskyddsmyndigheten (IMY) surveyed 20 major public and private sector organizations, finding its observations aligned with the EDPB’s conclusions.
Alongside the CEF report, the EDPB released a report summarizing input from a stakeholder workshop held December 12, 2025, focused on anonymization and pseudonymization. The workshop, attended by 105 participants from various sectors, sought to clarify how regulators view a recent Court of Justice of the European Union (CJEU) ruling on the topic. Participants called for more practical tools and guidance, particularly regarding the application of the ruling in joint controllership scenarios and the relationship between controllers and processors.
Stakeholders specifically requested clarification on assessing the identification capabilities of anonymized or pseudonymized data when transferred to third parties, determining what re-identification means are “reasonably likely” to be employed, and how controllers processing pseudonymized data can determine if it constitutes personal data. The EDPB has not yet announced a timeline for responding to these requests.
