A Controller is required to delete your personal data when: 

• It’s no longer necessary for the purpose it was originally collected. 

• You withdraw your consent and no other legal basis supports its retention. 

• It was processed unlawfully. 

• A legally mandated retention period has expired (e.g. for financial or judicial requirements). 

• If it relates to an ongoing judicial case, it must be retained only for as long as necessary for that case, then deleted 

Deletion must be implemented in a secure and irreversible manner: 

• Digital data must be permanently erased (e.g., using secure wipe tools), ensuring it cannot be recovered. 

• Paper records must be destroyed securely (e.g., shredding or incineration). 

• Backups and archives must also be cleaned after expiry or judicial hold ends. 

• Controllers should employ controlled mechanisms, technical tools and procedural checks to guarantee complete deletion.

How do they show they actually deleted it? 

Controllers must maintain a clear, auditable record of every deletion action, documenting: 

• What personal data was deleted (data type or record ID). 

• When it was deleted (timestamped). 

• How it was destroyed (e.g., wiped or shredded). 

• Who authorized or executed the deletion. 

• Why was the deletion performed (e.g., purpose fulfilled, or consent withdrawn). 

These records serve as an essential audit trail for proving compliance to regulators like SDAIA.