Right to Erasure

Under Article 17 of the UK GDPR, individuals have the right to have their personal data erased. This is also known as the right to get your data deleted, or the 'right to be forgotten'. The right applies only to data held at the time the request is received — it does not apply to data that may be created in the future — and it is not absolute, applying only in certain circumstances.

Those circumstances include: the organisation no longer needs the data for the original reason it was collected; the individual has withdrawn consent on which the processing was based; the individual has objected to the processing (including for direct marketing) and their interests outweigh the organisation's; the data was processed unlawfully; there is a legal obligation to erase it; or the data was collected from the individual as a child in connection with an online service, in which case the right applies with added weight even after the individual becomes an adult.

An organisation can refuse an erasure request in specified circumstances, including where retaining the data is necessary for freedom of expression and information, compliance with a legal obligation, the performance of a public interest task, the establishment or defence of legal claims, or archiving and research in the public interest. An organisation has one calendar month to respond to a request (extendable by up to two further months in complex cases) and cannot normally charge a fee unless the request is manifestly unfounded or excessive.