GDPR Update: Düsseldorf Court Confirms Fines for Improper Data Deletion
- Author: Arno Schlösser, DP-Dock GmbH
- Last updated: March 2026
- Category: Data Security, Enforcement
Case: Administrative Court Düsseldorf, 21 January 2026, AZ 29 K 7470/24
Topic: GDPR Article 15 – Right of Access & Data Deletion
Background
A company received a data access request under GDPR Article 15. The data subject received a 15-page document labeled as a data privacy disclosure. At the same time the company confirmed that the data subject’s personal data had been deleted and assured that it had not been shared with any third parties. The data subject complained that his questions had not been answered and that he never requested the deletion of his data.
Court Ruling
The Administrative Court Düsseldorf ruled that:
- Deleting data after receiving a data subject access request, but before giving full information, violates GDPR.
- Such deletion can be considered an attempt to conceal non-compliance, opening the door to administrative fines under GDPR Article 83.
Key Takeaways for Companies
- Ensure full compliance with data subject access requests before deleting data.
- Data deletion cannot be used to avoid transparency obligations.
- Violating these rules may lead to substantial fines, even if no individual employee acted negligently.
This ruling reminds us to take data subject access requests seriously and not delete data prematurely. It is the best way to protect customers’ rights and avoid costly fines.
If you have any questions regarding data access requests under Article 15 GDPR, please feel free to contact us.
