GDPR Article 17 lets people ask a controller to erase their personal data without undue delay when one of six grounds applies, for example the data is no longer needed or consent is withdrawn. Exceptions cover legal obligations, legal claims, and a few other cases, so it is not an absolute right.
The six grounds
Erasure must happen when:
- The data is no longer necessary for the purposes it was collected for.
- The person withdraws consent and no other legal basis supports the processing.
- The person objects and there is no overriding legitimate ground, or objects to direct marketing.
- The data was processed unlawfully.
- Erasure is required by EU or Member State law.
- The data was collected from a child in connection with online services under Article 8(1).
The exceptions
You may keep data to the extent processing is necessary for:
- Freedom of expression and information.
- Complying with a legal obligation, or a public interest task.
- Certain public health purposes.
- Archiving, scientific or historical research, or statistics, where erasure would seriously impair those aims.
- Establishing, exercising or defending legal claims.
Invoice records you must keep for tax reasons are the usual example of the legal obligation exception. Check the rules in your own country and record the reason for keeping each category.
Telling others
If you made the data public and must erase it, you must take reasonable steps, considering available technology and cost, to tell other controllers processing it that the person has asked for erasure of links, copies or replications.
What engineers need to build
- A user key across systems. Deletion fails when the same person has five identifiers in five tools.
- A deletion workflow that fans out to databases, search indexes, caches, analytics and processors, and records completion.
- Retention rules so data leaves automatically when the purpose ends. That also supports the storage limitation principle.
- A plan for backups. The article does not spell out how to treat backups. Many teams document that backups expire on a fixed cycle and that restored data is deleted again. Check with your authority's guidance and your counsel before relying on that.
- A legal hold flag so deletion pauses where a claim or obligation applies.
Proving it happened
Keep a log of the request, the decision, what was deleted and where, and the date. The accountability principle in Article 5(2) means you must be able to show compliance.
Quick check
Must we delete everything the person ever gave us?
Only where a ground applies and no exception does. Keep what the law requires and delete the rest.
Do processors need to delete too?
Under Article 28, the processor must at the controller's choice delete or return all personal data after services end, and must help with rights requests.
Sources
Last reviewed: 19 October 2026.
