Right to erasure

A person's right to have their data deleted.

If someone asks a company to erase the personal data it holds about them, the company has to do so, unless a legal exception lets it keep the data.

The GDPR Article 17 obligation to delete personal data on request, subject to legal retention exceptions. GDPR is the EU's General Data Protection Regulation, and the right is also called the right to be forgotten.

A person can ask for deletion in several situations:

• The data is no longer needed for the purpose it was collected for.
• Consent is withdrawn, and no other legal basis supports keeping the data.
• The person objects to the processing, and the organization has no overriding reason to continue.
• The processing was unlawful from the start.

Organizations can refuse or limit deletion in some cases:

• Legal obligations, such as record-keeping rules that require data to be kept.
• Legal claims, where the data is needed to establish or defend a claim.
• Public interest and other listed grounds, as the regulation describes.

Handling a request typically works like this:

1. The person submits a request, and the organization confirms their identity.
2. The organization finds the data across its systems, including backups and processors.
3. It deletes the data, or explains which exception applies.
4. It responds within one month, which can be extended in complex cases.

The right sits next to terms that are easy to mix up:

• GDPR is the law that creates the right.
• Data minimization is the principle of collecting less, which makes deletion easier.
• Biometric template is stored biometric data that a delete path has to reach.

For more, see the Privacy Hub.