Most privacy frameworks now include a right to have personal data deleted. The right exists. Exercising it reveals how systems are actually built.
Why deletion is hard
Data does not live in one place. It is copied to backups, replicated across regions, shared with processors, aggregated into analytics, and used to train models. Deleting the primary record does not touch any of that.
Backups are the clearest case. A system that retains backups for years cannot delete a record from them without restoring, editing and re-archiving every one. Most do not, and rely on the backup eventually expiring.
The model problem
Data used to train a machine learning model is, in a loose sense, inside the model. It cannot be extracted or deleted. Whether that counts as retention is a question regulators have not settled, and the answer determines whether an entire category of product is compliant.
What actually happens
Reputable organisations delete the active record, flag the identifier for exclusion from backups on restore, and remove the person from marketing systems. That is meaningful and incomplete.
Less reputable ones mark the record as deleted without removing it, which satisfies the letter of a query and nothing else.
What you can do
Request it anyway. The request creates an obligation and a record, and organisations that receive many requests build the capability to honour them.
Assume incompleteness. Data shared with a third party has been copied, and your deletion request reaches only the first hop.
Where this goes
Towards systems designed for deletion from the start – data with expiry built in, minimal copies, clear lineage. That is happening slowly in new systems and almost not at all in old ones.