The right to erasure is the data subject right, set out in Article 17 of the GDPR, to obtain from a controller the deletion of personal data without undue delay when one of the listed grounds applies. It is widely known as the right to be forgotten, a label that originates in the 2014 Google Spain judgment on search engine delisting.
Among user rights, erasure is the most operationally demanding. It is not absolute: the controller must check whether a ground for erasure exists, whether an exception applies, and then remove the data from every system, including copies held by processors, within the one-month response deadline.
When the right to erasure applies
Article 17 lists six grounds that trigger the obligation to erase. At least one must apply; a request that matches none can be refused with an explanation of the reasons and of the person’s right to complain to a supervisory authority.
| Ground | Typical situation |
|---|---|
| Data no longer necessary | Account closed and the purpose has ended |
| Consent withdrawn | Newsletter subscriber revokes consent and no other basis exists |
| Successful objection | Objection to legitimate interest or direct marketing processing |
| Unlawful processing | Data collected without any valid legal basis |
| Legal obligation to erase | Sector law requires deletion after a period |
| Child’s online services data | Data collected from a child through an information society service |
Consent withdrawal and erasure are related but distinct. Withdrawal stops future processing based on consent; erasure removes stored data. Withdrawal often creates a ground for erasure, but only when no other legal basis, such as a contract or a legal retention duty, still covers the data.
Exceptions that limit erasure
Article 17(3) sets out exceptions where processing remains necessary for an overriding purpose. In these cases the controller may keep the data, but only the part and only for the time the exception actually requires.
| Exception | Example | What can be retained |
|---|---|---|
| Freedom of expression and information | Journalistic archive article | Content needed for the public interest |
| Legal obligation or public task | Tax records kept for a statutory period | Invoices and accounting entries |
| Public health | Disease surveillance reporting | Data required by health law |
| Archiving, research, statistics | Longitudinal research study | Data where erasure would seriously impair the research |
| Legal claims | Dispute about a contract | Evidence for the establishment or defense of claims |
A common correct outcome is partial erasure: marketing profiles, browsing history and support notes are deleted, while invoices remain in the accounting system under restricted access until the statutory retention period ends.
Erasure compared with related user rights
Erasure is one of several rights that individuals often combine in a single request. Understanding the boundaries helps teams route requests correctly and avoid deleting data the person actually wanted to receive.
| Right | Outcome | Typical sequence |
|---|---|---|
| Right of access | Copy of data and processing details | Often requested before erasure |
| Data portability | Machine-readable export to the person or a new provider | Export first, then erase |
| Right to restriction | Data kept but frozen from use | Alternative while accuracy is disputed |
| Right to erasure | Data deleted or irreversibly anonymized | Final step in account closure |
| Right to object | Processing on a given basis stops | Can lead to erasure |
When data has been made public or disclosed to recipients, the controller must also take reasonable steps to inform other controllers processing it, and must notify each recipient of the erasure unless this proves impossible or involves disproportionate effort.
Implementing erasure in systems
The technical challenge is that personal data is rarely stored in one place. A customer record propagates into CRM, billing, analytics, email tools, data warehouses, logs and backups, and each copy needs a defined treatment.
Mature organizations maintain a data map that lists every system holding customer data and assign an erasure handler for each, whether an API call to a processor, a database job or a manual task. Requests are tracked in a ticket with deadlines and evidence of completion.
| Storage type | Recommended strategy | Note |
|---|---|---|
| Operational databases | Hard delete or irreversible anonymization | Preserve referential integrity |
| Processor systems | Deletion request through contract and API | Obtain confirmation |
| Analytics and warehouses | Delete user-level rows or remove identifiers | Aggregates may remain |
| Backups | Let backups expire on a defined cycle | Suppress restoration of erased records |
| Encrypted per-user data | Destroy the user’s key | Known as crypto-shredding |
Regulators generally accept that backups cannot be edited record by record, provided the data is put beyond use, the backup cycle is short and documented, and a suppression list prevents erased records from returning after a restore.
Common mistakes in handling erasure requests
- Deleting without verifying identity, which lets an impostor erase someone else’s account.
- Demanding excessive proof, such as a passport copy from a newsletter subscriber.
- Soft-deleting only, leaving records flagged as inactive but fully readable.
- Forgetting processors and third-party tools that hold copies.
- Missing the deadline of one month because requests arrive through unmonitored channels.
Each of these mistakes either fails the individual or creates a new risk, and supervisory authorities treat repeated failures as a sign of weak accountability.
The simple explanation
The right to erasure means you can ask a company to delete the information it holds about you, for example when you close an account or no longer want its marketing.
It works like asking a shop to shred your old customer card and all the notes about you. The shop must do it within about a month, everywhere it keeps copies. It may keep only what the law forces it to keep, such as invoices for the tax office, and must tell you why.
How it is used in practice
A customer of an online fitness subscription service cancels her membership and emails a request to delete all her data. The service verifies the request through the email address registered on the account rather than asking for identity documents.
Its erasure workflow deletes her profile, workout history and marketing preferences, sends deletion requests to the email platform and the analytics vendor, and removes her user-level rows from the data warehouse. Payment records stay in the accounting system with restricted access because tax law requires them to be retained for several years. Backups expire within 35 days, and a suppression list blocks her profile from being restored.
Three weeks after the request, she receives a confirmation listing what was deleted and what was retained, with the legal reason and the date the remaining records will be removed.