What is the GDPR right to erasure (right to be forgotten)?

The right to erasure is the GDPR right people know by its nickname, the right to be forgotten. It sounds absolute, and it is not. Article 17 gives a person the right to have their personal data deleted, but only when a specific ground applies, and it carves out situations where you can keep the data. Getting the distinction right is what separates a defensible refusal from a complaint to a regulator.

When does the right to erasure apply?

Article 17(1) lists six grounds. A controller must erase personal data without undue delay where: the data are no longer necessary for the purposes they were collected for; the person withdraws the consent the processing relied on and there is no other legal ground; the person objects under Article 21(1) and there are no overriding legitimate grounds, or objects to direct marketing under Article 21(2); the data have been unlawfully processed; erasure is required to comply with a legal obligation; or the data were collected from a child for online services under Article 8(1). If none of these applies, there is no automatic right to deletion.

When can you refuse an erasure request?

Article 17(3) sets out the exceptions. You do not have to erase to the extent that processing is necessary for the right of freedom of expression and information; for compliance with a legal obligation, or a task carried out in the public interest or official authority; for reasons of public interest in public health; for archiving in the public interest, scientific or historical research, or statistics under Article 89(1); or for the establishment, exercise or defence of legal claims. A tax record you are legally required to keep, for example, does not have to be deleted on request.

The right to be forgotten online

Where you have made personal data public and are obliged to erase it, Article 17(2) asks more of you. Taking account of available technology and the cost, you must take reasonable steps, including technical measures, to inform other controllers processing the data that the person has requested erasure of any links to, or copies or replications of, that data. This is the part that gives the right its forgotten name, and it is why the outcome reaches beyond your own database.

How fast must you respond?

Under Article 12(3) you must act on the request without undue delay and in any event within one month of receipt. You can extend by two further months where the request is complex or you receive a number of requests, but you must tell the person about the extension, with reasons, within the first month. Record what you decided and why, and keep your record of processing activities current so you can find the data an erasure touches.

Next step

The right to erasure is easy to get wrong in both directions: deleting data you are required to keep, or refusing a request that had a valid ground. The free 2-minute Obligation Scan flags where the GDPR applies to you and which data-subject rights, including erasure and access, you need a process for. Tell people about the right in your privacy notice, and see the GDPR compliance hub for the wider duties.