Right to Erasure

A data controller must erase personal data without undue delay where one of six specific grounds applies:

• Purpose Fulfillment: The data is no longer necessary for the original purpose.
• Consent Withdrawal: The data subject withdraws consent and no other legal basis exists.
• Objection Uphold: The data subject objects to processing and there are no overriding legitimate grounds.
• Unlawful Processing: The personal data has been processed unlawfully.
• Legal Obligation: Erasure is required to comply with a Union or Member State legal obligation.
• Child's Consent: The data was collected in relation to an information society service offered to a child.

Article 17 requires erasure without undue delay. While the GDPR does not define a strict statutory deadline, regulatory guidance interprets this as one calendar month, consistent with the general DSAR response timeframe. Complex or numerous requests may warrant a two-month extension, but the controller must inform the data subject of the delay within the first month. Automated orchestration is critical to meeting this timeline across fragmented data silos.

The right to erasure is overridden when processing is necessary for:

• Freedom of Expression: Exercising the right to freedom of expression and information.
• Legal Compliance: Complying with a legal obligation requiring processing by Union or Member State law.
• Public Interest: Performing a task carried out in the public interest or in the exercise of official authority.
• Public Health: Reasons of public interest in the area of public health.
• Archiving & Research: Archiving purposes in the public interest, scientific or historical research, or statistical purposes, where erasure would render impossible or seriously impair the achievement of those objectives.
• Legal Defense: The establishment, exercise, or defense of legal claims.

The controller who has made the personal data public has a specific obligation to take reasonable steps, including technical measures, to inform other controllers processing the data that the data subject has requested the erasure of any links to, or copy or replication of, that personal data. This requires maintaining a data lineage map to identify all downstream processors and sub-processors who received the data.

The GDPR acknowledges that erasure from live systems is distinct from backup and archival systems. Controllers are not required to destroy backup media immediately if doing so would be disproportionately difficult. However, they must ensure the data is 'put beyond use'—meaning it is not actively processed for any other purpose and is isolated from operational access. A clear policy for permanent deletion upon backup rotation is mandatory.

Before fulfilling an erasure request, the controller must verify the identity of the data subject, especially in digital environments. If the controller has reasonable doubts concerning the identity of the natural person making the request, they may request additional information to confirm identity. A controller may also refuse to act on a request if it is manifestly unfounded or excessive, but must demonstrate the excessive character and inform the data subject of the reasons for refusal and their right to lodge a complaint.