Right to Erasure
An individual’s right to request the deletion of their personal data, also known as the right to be forgotten.
The right to erasure, commonly known as the right to be forgotten, is established under GDPR Article 17. It gives individuals the right to request that an organization delete their personal data in certain circumstances: when the data is no longer necessary for its original purpose, when consent is withdrawn and no other legal basis applies, when the individual objects to processing and there are no overriding legitimate grounds, when data was unlawfully processed, when deletion is required by law, or when data was collected from a child in relation to online services.
The right to erasure is not absolute. Organizations can refuse erasure requests when the data is needed for exercising the right of freedom of expression, compliance with a legal obligation, public health purposes, archiving in the public interest or scientific research, or the establishment, exercise, or defense of legal claims. When a valid erasure request is received, the organization must delete the data without undue delay and, if the data was made public, take reasonable steps to inform other controllers processing that data of the erasure request.