The right to be forgotten, also called the right to erasure, lets people ask an organization to delete their personal data. It comes from Article 17 of the GDPR. You must respond within one month and erase the data if one of six grounds applies, unless an exception lets you keep it.
It is not absolute. You can refuse where you need the data to meet a legal obligation, defend a legal claim or protect freedom of expression, among other reasons. Below: the six grounds, the exceptions, a step-by-step process for handling requests, a response template, and how search engine delisting works.
Table of contents
- What is the right to be forgotten?
- When you must erase data: the six grounds
- When you can refuse: the exceptions
- Deadlines, fees and notifying others
- How to handle an erasure request
- Erasure response template
- The right to be forgotten and search engines
- Outside the EU
- FAQ
What is the right to be forgotten?
The phrase became famous in 2014, when the EU Court of Justice ruled in Google Spain that people could ask search engines to remove links to outdated or irrelevant information about them. The GDPR, in force since 2018, turned this into a broader right of erasure under Article 17. It applies to every controller that holds personal data, not just search engines.
Anyone whose data you hold can make a request: customers, users, employees, job applicants or newsletter subscribers. As with access requests, it can be made in any form, by email, phone, chat or letter, and does not need to mention Article 17.
When you must erase data: the six grounds
Under Article 17(1), you must erase personal data without undue delay if any of these apply:
| Ground | Example |
|---|---|
| The data is no longer needed for the purpose you collected it for | A former customer's order history after your retention period has passed |
| The person withdraws consent and you have no other legal basis | A newsletter subscriber who unsubscribes and asks to be deleted |
| The person objects to processing based on legitimate interests and you have no overriding grounds, or objects to direct marketing | Someone who asks you to stop using their data for marketing profiles |
| The data was processed unlawfully | Data collected without a valid legal basis |
| A legal obligation requires you to erase it | A court order or a national law that sets a maximum retention period |
| The data was collected from a child for an online service | An account created by a 14-year-old on a social app |
If none of the grounds apply, for example because you still need the data to deliver a service the person is using, you do not have to erase it. Explain why in your reply.
When you can refuse: the exceptions
Even when a ground applies, Article 17(3) lets you keep data that you need for:
| Exception | Example |
|---|---|
| Freedom of expression and information | A news article about a public figure |
| A legal obligation, or a task in the public interest | Invoices you must keep for tax purposes, often for six to ten years depending on the country |
| Public health | Records needed to monitor a disease outbreak |
| Archiving, research or statistics in the public interest, where erasure would seriously harm that work | A scientific study dataset |
| Legal claims | Records relevant to an ongoing dispute with the person |
Exceptions often apply to part of the data, not all of it. You might have to delete a former customer's marketing profile and support history while keeping their invoices. You can also refuse a request that is manifestly unfounded or excessive under Article 12(5), but the bar is high. See when you can deny a data subject request.
Deadlines, fees and notifying others
- One month to respond, extendable by two more months for complex or numerous requests if you tell the person within the first month.
- No fee, except for manifestly unfounded or excessive requests.
- Tell your recipients. Under Article 19, you must tell everyone you disclosed the data to, such as processors and partners, about the erasure, unless that is impossible or involves disproportionate effort.
- Public data. If you made the data public, for example by publishing it online, Article 17(2) requires you to take reasonable steps to tell other controllers processing it that the person wants links and copies erased.
How to handle an erasure request
1. Log the request
Record when it arrived, who made it and what they asked for. The one-month clock starts when anyone in your organization receives it.
2. Verify the person's identity
Use proportionate checks. Deleting the wrong person's data, or deleting data at the request of an impostor, is itself a breach.
3. Check the grounds and exceptions
Decide which ground applies and whether any exception lets you keep some of the data. Note your reasoning.
4. Find the data everywhere
Search your product database, CRM, support desk, email marketing tools, analytics, billing system and file storage. Your subprocessor list shows which vendors hold the data on your behalf, and each will need an instruction to delete it.
5. Delete or anonymize
Delete the data, or anonymize it so it can no longer identify the person. For backups, regulators generally accept that you put the data beyond use and let it expire on your normal backup cycle, as long as it is not restored into live systems. See deleting personal data from backups.
6. Notify recipients and confirm
Tell processors and other recipients to delete the data, then confirm to the person what you erased and anything you kept, with the reason. Keep a minimal record of the request itself as evidence that you complied.
Erasure response template
Subject: Your request to delete your personal data, reference [reference number]
Dear [name],
Thank you for your request of [date] to erase your personal data under Article 17 of the GDPR.
We have deleted the following data: [list of data or systems, for example account details, support tickets and marketing preferences]. We have also instructed our service providers who held this data on our behalf to delete it.
[If applicable: We are required to keep [data, for example invoices] until [date] to meet our legal obligations under [law]. We will delete it at the end of that period and will not use it for any other purpose.]
We have kept a record of your request and our response, which we need to show that we have complied.
If you are not satisfied with our response, you have the right to complain to [data protection authority and website].
Kind regards,
[Name, role, company]
The right to be forgotten and search engines
Search engines are controllers too, so people can ask them to delist results that appear when someone searches their name. The search engine weighs the person's privacy against the public interest in the information. Old, irrelevant or inaccurate information about a private person is likely to be delisted. Recent information about a public figure's professional conduct is not.
- Google Spain (2014): established that search engines must consider delisting requests.
- Google v CNIL (2019): the EU Court of Justice ruled that delisting applies across EU versions of a search engine, not worldwide.
- NT1 and NT2 v Google (2018): a UK court ordered Google to delist results about one businessman's old conviction but not the other's, showing how much depends on the facts.
Delisting removes the link from results for the person's name. It does not delete the page itself. To remove the content, the person has to contact the website that published it. Google, Bing and other search engines each have their own online request forms.
Outside the EU
- UK: the UK GDPR gives the same right of erasure, with the same grounds, exceptions and one-month deadline.
- California: the CCPA gives a "right to delete" personal information a business collected from the consumer. You have 45 calendar days to respond, extendable once by 45 days, and exceptions include completing a transaction, security, legal obligations and internal uses the consumer would reasonably expect.
- Other US states: Virginia, Colorado, Connecticut, Texas and others have similar deletion rights. There is no general US right to have search results delisted.
Failing to honor erasure requests under the GDPR falls in the higher tier of fines: up to €20 million or 4% of global annual turnover, whichever is higher.
ComplyDog gives you a privacy portal on your own domain where people can submit deletion, access and correction requests, and a dashboard to verify, track and complete each one. Start a 14-day free trial, no credit card needed.
FAQ
Is the right to be forgotten the same as the right to erasure?
Yes. Article 17 of the GDPR is titled "Right to erasure ('right to be forgotten')". The terms are used interchangeably.
Is the right to be forgotten absolute?
No. You only have to erase data if one of the six grounds applies, and you can keep data covered by an exception, such as records you must keep by law.
Can I keep a record that someone asked to be deleted?
Yes. You can keep the minimum information needed to show you handled the request. If someone asks to stop marketing, you can also keep their email on a suppression list so they are not added again.
How long do I have to delete the data?
Without undue delay, and within one month of the request. You can extend by two more months for complex cases if you tell the person within the first month.
