GDPR Q12

What is the right to be forgotten?

Q12. What is the right to be forgotten?

Category: Rights

The right to be forgotten, or right to erasure, lets people ask you to delete personal data in specific situations.

In simple terms

Erase data when it is no longer needed or consent is withdrawn.
You can refuse in limited cases, such as legal obligations.
Keep a log of erasure requests and your decisions.

When erasure applies

Article 17 lists the circumstances. Key triggers include when data is no longer necessary, consent is withdrawn, processing is unlawful, or the person objects and there are no overriding interests.

Check whether the data is needed for an ongoing contract.
Delete data collected for direct marketing immediately when someone objects.
Remove data gathered from children for online services when consent is withdrawn.

When you can refuse

You may keep data when processing is required for freedom of expression, legal obligations, public interest tasks, or legal claims. Explain the reason clearly if you refuse.

Retain records needed for tax or regulatory duties.
Keep minimal information to defend legal claims, such as dates of employment.
If you refuse, inform the person how they can complain to the ICO.

Managing erasure

Act without undue delay—within one month unless the request is complex. Notify any processors or recipients so they can delete their copies where possible.

Use workflows to cascade deletion across systems and backups.
Keep a suppression list to avoid re-adding deleted contacts.
Confirm completion to the requester once the data is erased.

Practical steps to take

Verify the requester’s identity and confirm the scope of the data.
Check for legal reasons that require keeping some records.
Delete or anonymise data in live systems and schedule deletion in backups.
Notify third parties who received the data where feasible.
Record the request, outcome, and rationale in your log.

Real-life examples

Marketing opt-out

A customer cancels their newsletter subscription and asks for their profile to be deleted. The company removes the account, keeps a suppression record, and confirms completion.

Former student

A college alum requests deletion of their contact details. The college deletes marketing records but retains exam results because it has a legal obligation to keep academic history.

Helpful reminders

Do not delete data that you need to keep for legal compliance, but explain why.
Ensure backups are handled—document when data will disappear from them.
Train staff to recognise erasure requests, even if they are informal.
Consider whether anonymisation is a suitable alternative.

Key takeaway

Balance individuals’ rights with legal duties—erase when you can, explain when you cannot, and always log the decision.

Article references

Article 17 – Right to erasure