The right to erasure GDPR framework establishes under Article 17 is one of the most powerful rights available to individuals. Often referred to as the “right to be forgotten,” it allows data subjects to request that a controller delete their personal data without undue delay. For Data Protection Officers and compliance teams, erasure requests present a distinctive operational challenge: they demand a careful assessment of legal grounds, an exhaustive data inventory, and a clear understanding of the exceptions that can override the obligation to delete.
An erasure request rarely maps to a single “delete account” action. The same customer may appear in marketing lists, support records, invoices and litigation evidence. The controller must decide what must be erased, what may still be retained for a defined purpose, and how to explain a partial refusal.
This guide explains when the right to erasure applies, what exceptions exist, how to process deletion requests, and where organizations most commonly fall short.
What Is the Right to Erasure Under GDPR?
The right to erasure is codified in Article 17 of the GDPR. It grants every data subject the right to obtain from the controller the erasure of their personal data without undue delay. The controller has a corresponding obligation to erase that data where one of six specific grounds applies.
When Does the Right Apply?
A data subject can invoke the right to erasure GDPR provides in any of the following circumstances:
- The data is no longer necessary for the purposes for which it was collected or processed. This is directly connected to the purpose limitation and storage limitation principles — once data has served its original purpose and no other lawful basis justifies retention, deletion is mandatory.
- The data subject withdraws consent and there is no other legal ground for processing. Where processing was based on valid GDPR consent, withdrawal of that consent triggers the erasure obligation unless another lawful basis applies.
- The data subject objects under Article 21(1) and there are no overriding legitimate grounds, or objects to direct marketing under Article 21(2), for which no balancing override applies.
- The personal data has been unlawfully processed. Any processing that violates the data privacy principles renders the data subject eligible to demand deletion.
- Erasure is required to comply with a legal obligation in EU or Member State law.
- The data was collected in relation to information society services offered to a child under Article 8(1).
The Extended Obligation Under Article 17(2)
Article 17(2) applies where the controller made personal data public and is obliged to erase it. Taking available technology and implementation cost into account, it must take reasonable steps, including technical measures, to inform controllers processing the data that the person requested erasure of links, copies or replications. Separately, Article 19 requires communication of erasure to recipients, unless impossible or disproportionate, and information about those recipients if the person requests it. Processors must assist under their Article 28 arrangements; keep the recipient map in the accountability records.
What Are the Exceptions to the Right to Erasure?
The right to erasure is not absolute. Article 17(3) sets out exceptions where the controller may lawfully refuse an erasure request. Understanding these exceptions is essential for compliance teams assessing incoming deletion requests.
Grounds for Refusing Erasure
The GDPR permits controllers to refuse erasure where processing is necessary for:
- Exercising the right of freedom of expression and information. This exception is particularly relevant for media organizations and publishers, ensuring that journalistic, academic, artistic, or literary expression is not curtailed by erasure requests.
- Compliance with a legal obligation that requires processing under EU or Member State law. The exception also covers a task in the public interest or exercise of official authority vested in the controller. Tax, anti-money-laundering and employment retention rules must be identified for the particular record and jurisdiction — a documented GDPR data retention policy is what makes these refusals defensible.
- Reasons of public interest in the area of public health in accordance with Articles 9(2)(h) and 9(2)(i), as well as Article 9(3).
- Archiving purposes in the public interest, scientific or historical research, or statistical purposes under Article 89(1), where erasure would render impossible or seriously impair the achievement of those objectives.
- The establishment, exercise, or defense of legal claims. Organizations may retain data reasonably necessary for ongoing or anticipated litigation.
The French data protection authority, CNIL, has published guidance confirming that controllers must assess each exception on a case-by-case basis. A blanket refusal without a documented justification is itself a compliance violation.
Handling Erasure Requests in Practice
Processing an erasure request under the right to erasure GDPR framework requires a structured, documented workflow. Organizations that lack a clear procedure frequently miss the statutory response deadline, fail to erase data from all systems, or refuse requests without proper justification.
Receiving, Verifying, and Assessing the Request
Every erasure request must be logged with the date of receipt, the identity of the requester, and the specific data or processing activities to which the request relates. As with a data subject access request, controllers must be satisfied that they are acting for the correct person. A logged-in request may already provide sufficient assurance; additional information is appropriate under Article 12(6) only where there are reasonable doubts about identity. However, verification measures must be proportionate — Article 12(6) does not permit controllers to impose barriers that discourage individuals from exercising their rights.
Before deleting anything, the compliance team must determine whether one of the six grounds in Article 17(1) is met. If none applies, the request may be declined. Equally important is assessing whether any Article 17(3) exception permits continued retention. This assessment must be documented — the accountability principle demands that controllers demonstrate the reasoning behind every decision.
Executing Deletion Across All Systems
If erasure is required, act without undue delay. Article 12(3) separately requires information on the action taken within one month of receipt. That is a calendar month, not a fixed 30 days and not permission to delay straightforward deletion. An extension by two further months may be necessary because of complexity or the number of requests; explain the extension and its reasons within the first month.
Locate the data in primary systems, archives, exports, processors and relevant recipients. The EDPB’s 2025 coordinated erasure report, adopted in February 2026, drew on responses from 764 controllers through 32 participating authorities. It identified practical problems including backup handling and weak anonymisation. These questionnaire results are not a universal failure rate. A controller needs a documented process for each storage layer and evidence that the chosen measure works.
Once deletion is complete, the controller must inform the data subject. Under Article 19, the controller must also notify each recipient to whom the personal data was disclosed, unless this proves impossible or involves disproportionate effort. Internal documentation of the entire process is essential for demonstrating compliance.
Example: Closing an Account With Outstanding Invoices
Suppose a former customer asks for “everything to be deleted”. Create a disposition record that separates the datasets:
| Dataset | Decision to investigate | Completion evidence |
|---|---|---|
| Marketing profile and campaign audiences | Honour a marketing objection and assess erasure; prevent re-import into campaigns | Removal confirmation and a limited, justified suppression record |
| Closed support tickets | Determine whether they remain necessary, including any actual claim | Deletion or redaction result; precise reason and duration for any retained subset |
| Invoices | Check the applicable statutory retention duty | Record type, legal provision, expiry date and restricted purpose |
| Processor copies | Issue the scoped instruction and confirm how downstream copies are handled | Supplier acknowledgement and completion evidence |
| Backups | Identify the next expiry, access restrictions and restoration procedure | Backup schedule and evidence that restored data will be re-erased before normal use |
A tax retention duty for invoices does not justify retaining the entire marketing profile. Explain the records erased, any remaining categories, the particular exception and relevant retention period or criteria. For a refusal, Article 12(4) requires reasons and information about a supervisory-authority complaint and judicial remedy. Keep only proportionate evidence of the request itself under a documented purpose and retention rule.
Test restoration as well as deletion: otherwise an old backup can silently repopulate a live system. A documented backup limitation is not a blanket exemption or permission to use the data again.
Enforcement Consequences for Non-Compliance
Under Article 83(5)(b), infringements of data subject rights fall within the tier of up to EUR 20 million or 4% of the undertaking’s worldwide annual turnover, whichever is higher. Authorities can also use corrective powers, including ordering compliance with a request. A particular fine depends on the facts and Article 83 factors.
Beyond fines, failure to comply with the right to erasure GDPR mandates can trigger formal complaints, reputational harm, and litigation. Organizations that have experienced a data breach should expect an increase in erasure requests in the aftermath — and failing to respond properly during that period compounds both legal and reputational exposure.
Restricting access or moving a record into an archive does not by itself erase it. Genuine anonymisation may remove personal-data status, but replacing a name with a stable code usually does not. Assess whether identification remains reasonably likely and retain the evidence for the technique used.
FAQ
Can an organization charge a fee for an erasure request?
Under Article 12(5), the right to erasure must be exercised free of charge. However, where requests are manifestly unfounded or excessive — particularly when they are repetitive — the controller may charge a reasonable fee based on administrative costs or refuse to act entirely. The burden of demonstrating that a request is manifestly unfounded or excessive falls on the controller.
Does the right to erasure apply to backup systems?
Yes. The right to erasure GDPR framework applies to all copies of personal data, including backups. However, regulators such as the ICO have acknowledged that immediate deletion from backup systems may be technically impractical. Controllers should ensure that backup data is excluded from any future restoration and is deleted when the backup cycle naturally expires. This approach must be documented and communicated to the data subject.
What should organizations do when erasure conflicts with a retention obligation?
When a statutory retention period applies — for instance, a tax rule requiring specified financial records to be retained for a defined period — the controller may refuse the erasure request under the Article 17(3)(b) exception. The refusal must be communicated to the data subject with a clear explanation of the legal basis for continued retention and information about their right to lodge a complaint with a supervisory authority.