Right to Erasure
An individual's right to have their personal data deleted ('right to be forgotten') in certain circumstances.
Full Definition
The Right to Erasure, also known as the 'right to be forgotten', allows individuals to request the deletion of their personal data in certain circumstances defined by Article 17 of GDPR: the data is no longer necessary for its original purpose, consent has been withdrawn and there is no other lawful basis, the individual objects and there is no overriding legitimate interest, the data has been unlawfully processed, or legal obligation requires erasure. The right is not absolute — it can be overridden for exercising freedom of expression, compliance with a legal obligation, scientific/historical research, or the establishment or exercise of legal claims. Organisations must respond within 30 days and ensure erasure cascades to downstream processors.
Related terms
DSAR
Data Subject Access Request — a formal request from an individual to access the personal data an organisation holds about them.
Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
Data Minimisation
The principle that only personal data that is adequate, relevant, and limited to what is necessary should be collected and processed.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.