Data erasure is the right to request deletion of personal data when applicable legal conditions are met. It does not mean every deletion request must be granted: the organization must assess the relevant law, the purpose and legal basis for processing, and any exceptions that apply.
In cybersecurity and AI governance, erasure matters because personal data may be copied across systems or used to train machine-learning models. Deleting a source file may not remove its influence from a trained model. Organizations should track data provenance and system versions, document how requests are assessed, and use appropriate measures-such as deleting records, retraining, targeted unlearning, or limiting outputs-where required. The chosen approach should be tested and recorded so the response can be audited.