Right to Erasure
An individual's right to have their personal data deleted ('right to be forgotten') in certain circumstances.
Full Definition
The Right to Erasure, also known as the 'right to be forgotten', allows individuals to request the deletion of their personal data in certain circumstances defined by Article 17 of GDPR: the data is no longer necessary for its original purpose, consent has been withdrawn and there is no other lawful basis, the individual objects and there is no overriding legitimate interest, the data has been unlawfully processed, or legal obligation requires erasure. The right is not absolute — it can be overridden for exercising freedom of expression, compliance with a legal obligation, scientific/historical research, or the establishment or exercise of legal claims. Organisations must respond within 30 days and ensure erasure cascades to downstream processors.
How each law treats it
The 'right to be forgotten' applies where consent is withdrawn, data is no longer necessary, the subject objects, data was unlawfully processed, or a legal obligation requires erasure.
Data Principals may request erasure where the purpose is served, consent is withdrawn, or retention is otherwise unnecessary. Erasure yields to retention required by law.
Consumers have the right to request deletion of personal information collected about them, subject to narrow exceptions (completing a transaction, security, legal compliance).
In practice
- Build the erasure workflow to cover every system holding the data, including backups and analytics replicas. Backups can be addressed with a documented 'erase on next restore cycle' policy.
- Record the legal basis for refusing partial erasure (law, contract, legitimate ground). The regulator will ask for the specific exception.
- Erasure of linked data (comments, reviews, logs) is often the hard part. Anonymise where you can't delete.
Common pitfalls
- Treating 'disable account' as erasure. GDPR erasure means removal; a soft-delete flag is not sufficient.
- Over-honouring the request where legal retention obligations apply. Tax, labour and SOX records usually override erasure.
- Not informing third-party recipients. GDPR Article 19 requires notification to each recipient unless impossible or disproportionate.
Frequently asked questions
What's the difference between erasure and anonymisation?+
Erasure removes the data; anonymisation makes it non-personal while retaining analytic value. Both satisfy the right where the subject's primary concern is being removed from personal-data processing.
Can I refuse erasure for business reasons?+
No. The GDPR's exceptions are specific — freedom of expression, legal obligation, public interest, legal claims. 'We'd like to keep it' is not a valid exception.
Does erasure extend to backups?+
Yes, but with a documented policy that marks the data for erasure on the next backup rotation. Keeping backups permanently with a 'to be deleted' flag is accepted by most DPAs; keeping them indefinitely is not.
Related terms
DSAR
Data Subject Access Request — a formal request from an individual to access the personal data an organisation holds about them.
Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
Data Minimisation
The principle that only personal data that is adequate, relevant, and limited to what is necessary should be collected and processed.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes