Right to erasure

The right to erasure under Article 17 GDPR is also known as the right to be forgotten. A data subject may require a controller to erase personal data without undue delay where, for example, the data is no longer necessary for its original purpose, consent has been withdrawn and no other legal basis applies, an objection is not outweighed by overriding legitimate grounds, the processing was unlawful or a legal obligation requires erasure. A further ground concerns data relating to children in information-society services.

The right is not absolute. Erasure may be refused where processing is necessary for freedom of expression and information, a legal obligation, a task in the public interest, certain archiving, research or statistical purposes, or the establishment, exercise or defence of legal claims. If a controller has made the data public, it must take reasonable steps, taking account of available technology and the cost of implementation, to inform other controllers about the request. This does not mean that every copy on the internet disappears automatically.

In practice, an erasure request should be addressed to the correct controller and describe the data and processing concerned sufficiently to make them identifiable. The controller must generally respond within one month and explain the relevant reasons if it refuses. The overview of data subject rights and access provides the wider context; further connections are collected in the data protection glossary.