Not sure if all posts must be deleted or just remove the reference to the user (as poster).

My understanding is that personal data should be removed, including the avatar but not the contenet.

Hi @anonymous20 @robert,

GDPR enables the right to be forgotten, which by definition (unless there is a regulatory or legal reason for you to retain any information), got are legally required by ICO guidelines and regulation to delete all data associated with that individual. By definition, this includes all posts etc that can be attributed to that individual. 

Not sure if all posts must be deleted or just remove the reference to the user (as poster).

GDPR enables the right to be forgotten, which by definition (unless there is a regulatory or legal reason for you to retain any information), got are legally required by ICO guidelines and regulation to delete all data associated with that individual. By definition, this includes all posts etc that can be attributed to that individual. 

An other puzzle is

"Be able to delete a customer and all records associated with the customer, across all your systems, within a month of request."

What happens when you delete a user ? You must delete his posts also ?

wpForo asks to delete all posts and topics of this user when you delete a user:

https://wpforo.com/docs/root/members/member-manager/#delete

https://wpforo.com/wp-content/uploads/2016/08/wpForo-Delete-forum-member-with-forum-posts.png

https://www.cennydd.com/writing/a-techies-rough-guide-to-gdpr

"Be able to delete a customer and all records associated with the customer, across all your systems, within a month of request."

What happens when you delete a user ? You must delete his posts also ?

Thank you for the information. Sure this is not a site specific and I don't think this is a site specific too. I said this is a site-wide, this is not a forum specific. I mean forum is a part of the whole site so this should be done for whole website not for a part of the site like forum. And yes this is a very important thing and we're following to the issue.

It is not site specific only.

I'm not a lawyer but see and example of what i mean:

Data Subject Rights

In plain English, a data subject is any EU citizen from which you are collecting personal data. GDPR compliance requires data subjects be granted certain rights. What follows is not an exhaustive list, but those rights that are relevant to the collection, processing, and storage of personal data on your WordPress website.

Right to Access. Data subjects must be able to request and obtain confirmation that data is or is not being collected on them, and if so exactly what data is being collected, how, where, and for what purpose. That data must also be provided to them in an electronic format free of charge on request.

Right to Be Forgotten. Data subjects must be provided a quick and painless way to withdraw consent and have collected data purged.

Data Portability. Similar to the Right to Access, Data Portability requires that data subjects are able to request, obtain, and/or transfer possession of collected data at any time.