GDPR Article 17 and the right to erasure: what email providers must do

Article 17 of the GDPR — the "right to erasure", often called the right to be forgotten — lets individuals ask an organisation to delete their personal data. For an email provider, that raises a specific and practical question: when a mailbox is deleted, is it really gone?

What the right actually requires

Erasure is not absolute — there are lawful grounds to retain some data, such as records needed for legal obligations or the defence of legal claims. But the default is deletion on request, across primary storage and backups, within a reasonable period, and with confirmation to the individual.

The backup problem

The hard part is backups. Data legitimately copied into a backup cannot always be surgically removed the moment a deletion request arrives. The accepted approach is to put deleted data "beyond use" — excluded from restores and expired on the normal backup rotation — and to document that policy clearly.

• Primary mailbox data is deleted promptly on request.
• Backups are excluded from restore and expire on the standard rotation.
• The account holder receives confirmation once erasure completes.

How Airfree Mail handles it

Because Airfree Mail is zero-knowledge, deleted mail is unreadable to us the instant the account keys are destroyed — even data still on a backup tape is ciphertext with no key. Deletion requests are processed within 30 days, backups roll off on their normal cycle, and you receive written confirmation. Our data-retention policy sets out the exact timelines.