[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flKo2h9Z-Amf0Eb9iSCPfyAuBSSEFE6ZnogZ87AJCJVI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"fda943ba-13f1-4ea8-a801-aaace90b5b46","cjeu-rules-individuals-may-request-erasure-from-church-baptism-registers-under-gdpr","7eb2a186-66b5-423a-9c8a-4f70da06f447","CJEU Rules Individuals May Request Erasure from Church Baptism Registers Under GDPR","This case highlights the tension between religious organizations' record-keeping practices and individuals' GDPR rights, specifically the 'right to erasure' (Article 17). The Advocate General's opinion signals that churches and religious bodies are not automatically exempt from GDPR obligations simply because records are historical or ecclesiastical in nature. Organizations that retain personal data must be able to articulate a clear, lawful basis for processing and be prepared to honor erasure requests unless a narrow exception applies. This matters because failing to have defined data retention and erasure policies exposes organizations — including religious institutions — to regulatory scrutiny and legal liability. The ruling reinforces that any entity processing personal data of EU residents must treat GDPR compliance as an active, ongoing obligation rather than a bureaucratic formality.","**Immediate actions:**\n- Conduct an audit of all personal data held in legacy or non-digital records to assess GDPR applicability and lawful basis for retention.\n- Establish a documented process for receiving, logging, and responding to data subject erasure requests within the statutory 30-day window.\n\n**Policy & Governance improvements:**\n- Define and document a lawful basis for every category of personal data processed, including historical and archival records, and review these annually.\n- Develop a data retention schedule that specifies how long each category of personal data is kept and the criteria used to determine retention periods.\n- Train staff and volunteers who handle personal data on GDPR rights, including the right to erasure and the limited exceptions that allow refusal.\n\n**Long-term compliance measures:**\n- Appoint or designate a Data Protection Officer (DPO) or compliance lead responsible for monitoring regulatory developments and managing data subject requests.\n- Implement a privacy-by-design review process so that any new record-keeping system or database is assessed for GDPR compliance before deployment.\n- Establish a formal appeals and escalation procedure for disputed erasure requests, including legal review criteria aligned with GDPR Article 17 exceptions.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 17 (Right to Erasure \u002F Right to be Forgotten)","GDPR Article 6 (Lawfulness of Processing)","GDPR Article 9 (Processing of Special Categories of Personal Data)","GDPR Article 89 (Safeguards for Archiving and Research)","GDPR Article 37-39 (Data Protection Officer Requirements)","NIST Privacy Framework PR.DS-P1 (Data Management Policy)","NIST SP 800-188 (De-Identification of Government Datasets)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 (Privacy Information Management System)","ITIL Service Design — Information Security Management",{},"published","2026-10-07T14:21:28.284063+00:00","2026-10-07T14:21:27.964+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-12\u002F25&diff=53326&oldid=53313","cjeu-c-12-25-1a62cf","CJEU - C-12\u002F25",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]