- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed – Invoking this requirement is consistent with the purpose limitation principle, which requires personal data to be collected for specific, explicitly indicated and legitimate purposes;
- the data subject withdraws his consent on which the data processing is based – rests on the freedom to give and withdraw consent to the processing of personal data;
- the data subject objects to the processing and there is no overriding legal basis for continuing the processing – consequence of exercising the right to object under Art. 21, par. 1 of the GDPR.;
- personal data has been processed unlawfully – rests on the rule that no one can derive rights from unlawful conduct;
- the personal data must be deleted in order to comply with a legal obligation under Union law or the law of a Member State that applies to the controller;
- personal data has been collected in connection with the provision of information society services to a child.