GDPR Right to Erasure: Grounds, Refusals, and Penalties

The GDPR right to erasure, set out in Article 17 of the General Data Protection Regulation and sometimes called the right to be forgotten, lets you require an organization to delete your personal data when one of six specific conditions applies. It is not an absolute right. The organization can refuse in defined situations, and knowing both sides of that line is what makes a request effective rather than wasted.

Six Grounds That Trigger Deletion

Article 17(1) lists six situations where an organization must delete your personal data on request. Each stands on its own, so you only need to meet one.¹

The data is no longer needed for the purpose it was originally collected. A retailer that kept your phone number for a one-time delivery has no ongoing reason to store it.
You withdraw consent you previously gave, and the organization has no other legal basis for keeping the data. This comes up often with marketing profiles and behavioral tracking.
You object to the processing under Article 21 and the organization cannot show a compelling reason that overrides your interests. Direct marketing is the clearest example, because Article 21 gives you an unconditional right to stop that kind of processing.²
The data was processed unlawfully, meaning there was no valid legal basis for collecting or handling it in the first place.
EU or member state law requires the data to be deleted.
The data was collected from a child in connection with an online service such as a social media platform or app. Children receive heightened protection under the GDPR.¹

When an Organization Can Lawfully Refuse

Article 17(3) sets out five situations where a controller can keep the data despite your request.¹

Freedom of expression and information. News reporting, historical documentation, and public discourse cannot be suppressed simply because someone wants unflattering facts removed.
Legal obligation or public task. If EU or member state law requires the processing, or the processing is necessary to carry out a public-interest task or exercise official authority, erasure does not apply. Banks retaining transaction records for anti-money-laundering compliance are a familiar example.
Public health. Data used for disease tracking, medical safety monitoring, and similar purposes can be retained.
Archiving in the public interest, scientific or historical research, or statistical purposes, but only where deletion would seriously undermine those objectives and appropriate safeguards are in place.
Establishment, exercise, or defense of legal claims. An organization facing litigation or a regulatory investigation can keep records relevant to that dispute.³

The organization has to justify which exemption applies. A vague reference to “business needs” is not enough.

How to Send the Request

You do not need a lawyer or a special form. A written request to the organization’s Data Protection Officer is enough. Most companies publish DPO contact details in their privacy policy, typically linked at the bottom of the website, and some offer dedicated online portals that speed things up.

Give the organization enough detail to find your data and confirm who you are:

Proof of identity. A copy of a government-issued ID, or a message sent from the email address on file, lets them avoid deleting the wrong person’s records.
A specific description of the data. Account numbers, dates of service, URLs, or the types of records involved all help narrow the search.
A brief reason. The GDPR does not strictly require you to cite a ground, but saying something like “I am withdrawing my consent” or “the data is no longer needed for its original purpose” tends to produce faster responses.

If you are submitting on behalf of someone else, such as a child, you will normally need written authorization along with proof of both identities.

How Long They Have, and What It Costs

The controller must act without undue delay and no later than one month after receiving the request. That deadline can be extended by two further months where the request is complex or the organization is handling many requests, but the extension and the reasons for it have to be communicated to you within the first month.⁴

The request is free in almost every case. If a request is “manifestly unfounded or excessive,” in particular because it is repetitive, the organization can charge a reasonable administrative fee or refuse to act, but it bears the burden of proving that threshold is met.⁴

How Far the Deletion Reaches

Erasure does not stop with the organization you contacted. Under Article 19, the controller has to notify every recipient it shared your data with about the deletion, unless doing so is impossible or involves disproportionate effort.⁵ In practice, the erasure should cascade through the supply chain to partner firms and service providers that received copies.

Where the controller made your data public, Article 17(2) adds a further step: it must take reasonable steps, considering available technology and cost, to inform other controllers processing that data that you have requested deletion of any links to, copies of, or replications of it.¹ This is the provision that gives the right its “right to be forgotten” character, extending beyond a single database to data that has spread online.

Search Engine Delisting

One of the most common uses of the right is asking a search engine to delist specific results tied to your name. This does not delete the underlying webpage; it removes the link so a search for your name no longer surfaces it. Google and other major search engines operating in the EU maintain dedicated request forms.

You will normally need to provide the specific URLs, an explanation of why the content is irrelevant, outdated, or otherwise inappropriate, and proof of identity. Search engines weigh your privacy interest against the public’s interest in accessing the information. Requests targeting outdated criminal records, old personal debts, or stale personal content tend to succeed more often than attempts to remove recent newsworthy material. A search engine that refuses is subject to the same enforcement mechanisms as any other controller.

If Your Request Is Refused

A refusal must come with reasons and information about your right to complain to a supervisory authority or seek a judicial remedy. Read the stated reason carefully. If the organization cites an Article 17(3) exemption, ask whether it genuinely applies. A retailer invoking the “legal claims” exemption for three-year-old marketing data would have a hard time justifying that.

Your next step is a complaint to the relevant supervisory authority. Every EU member state has one; France has the CNIL, Ireland has the Data Protection Commission, and Germany operates at state level. You can file with the authority where you live, where you work, or where the alleged violation occurred. It can investigate, order compliance, and impose fines.⁶

You can also pursue the matter through the courts. Article 82 gives anyone who suffers material or non-material damage from a GDPR infringement a right to compensation from the controller or processor responsible. Non-material damage includes distress and anxiety, so a financial loss is not required to bring a claim.⁷

Which Organizations Are Bound

Every organization established in the EU or EEA that processes personal data has to comply. The rule reaches further than that, though. Under Article 3(2), the GDPR applies to controllers and processors outside the EU whose processing involves offering goods or services to people in the EU (even for free) or monitoring the behavior of people while they are in the EU.⁸

A US e-commerce company shipping to European customers, or a mobile app tracking users in France or Germany, is subject to the same erasure obligations as a company headquartered in Berlin. If a website targets EU customers through language options, euro pricing, or EU-focused marketing, it likely falls within scope.

Penalties for Ignoring a Request

Mishandling an erasure request sits in the higher of the GDPR’s two fine tiers. Infringements of data subject rights under Articles 12 through 22 can attract fines of up to €20 million or 4% of the organization’s total worldwide annual turnover from the preceding financial year, whichever is greater.⁹ Combined with the individual right to compensation under Article 82, this gives organizations strong reasons to take erasure requests seriously.⁷

1
GDPR-Info.eu. Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
2
GDPR-Info.eu. Art. 21 GDPR – Right to Object
3
Legislation.gov.uk. Regulation (EU) 2016/679 – General Data Protection Regulation
4
GDPR-Info.eu. Art. 12 GDPR – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
5
GDPR-Info.eu. Art. 19 GDPR – Notification Obligation Regarding Rectification or Erasure of Personal Data or Restriction of Processing
6
Data Protection Commission. The Right to Erasure (Articles 17 and 19 of the GDPR)
7
GDPR-Info.eu. Art. 82 GDPR – Right to Compensation and Liability
8
GDPR-Info.eu. Art. 3 GDPR – Territorial Scope
9
GDPR-Text.com. Article 83 GDPR – General Conditions for Imposing Administrative Fines