> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain dat

> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? You record that these people need to be scrubbed if you restore backups, and you delete old backups. The ICO has excellent guidance on this and other subjects: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests I can't understand what your question is. There's absolutely no reason someone can delete spam from their public forum, but can't delete people's phone numbers from items that are pointed out to them. If they have no search capabilities, and don't use a search capability, they're not required to create one. The GDPR is extremely easy to comply with- European companies have been doing it for a long time (before it gained the force it has now) because it's largely a unification of existing data protection laws.