The Right to Erasure Under GDPR Article 17: When You Must Delete, and When You May Refuse

When a person can demand deletion

Under Article 17(1) GDPR, you must erase personal data without undue delay if one of these grounds applies:

If none of the grounds applies, there is no right to erasure, but check whether the person really wants something else, such as to stop marketing or to correct data.

When you may refuse

Article 17(3) lists five exceptions. They apply only to the extent the processing is necessary for:

• freedom of expression and information, relevant mainly for media and search engines;
• a legal obligation in Union or national law, or a public task, the most common exception for businesses: tax, accounting and anti-money-laundering records must be kept for the periods the law sets;
• public health under Article 9(2)(h) and (i);
• archiving, research or statistics under Article 89(1), if erasure would make the objectives impossible or seriously impair them;
• the establishment, exercise or defence of legal claims, for example records needed for a pending or reasonably expected dispute.

Partial erasure is common: an exception covers only the data it requires. When a customer asks to be deleted, you may need to keep invoices for the tax retention period while deleting the marketing profile, support history and account data. Explain what you kept, why, and until when.

Article 18 gives the person an alternative: restriction. If they contest accuracy, or the processing is unlawful but they prefer restriction to deletion, or they need the data for a legal claim, you keep the data stored but stop using it.

Deadlines and form

The one-month limit is for your response; the erasure itself must happen without undue delay. A request does not need to mention Article 17 or use any particular words.

Telling others

Under Article 19, you must pass the erasure on to each recipient to whom you disclosed the data, such as processors, partners or group companies, unless this proves impossible or involves disproportionate effort, and tell the person who those recipients are if they ask. Your processors must help you respond under Article 28(3)(e) and delete on your instructions.

Under Article 17(2), if you made the data public, for example on a website, you must also take reasonable steps, taking account of available technology and cost, to inform other controllers processing it that the person has asked for links, copies or replications to be erased.

Search engines

Delisting from search results is a right against the search engine operator. In Google v CNIL (C-507/17, 24 September 2019) the Court of Justice held that an operator granting a request must delist on the versions of its search engine for all Member States, but is not required by EU law to do so worldwide.

Backups and anonymisation

These were two of the problems regulators found most often. The EDPB's report on the 2025 coordinated action accepts that it is not always advisable to alter backups, since they protect against incidents such as ransomware. In that case you need a procedure to track erasure requests and apply them again if a backup is restored, and backup retention periods short enough that deletion still happens without undue delay.

Anonymisation can replace deletion only if the result is truly anonymous, meaning the data can no longer be linked to an identifiable person. The report found controllers relying on ineffective techniques; pseudonymised data, where re-identification remains possible, is still personal data.

What regulators found in 2025

In its report adopted on 10 February 2026, the EDPB summarised the findings of 32 supervisory authorities, to which 764 controllers responded. The overall level of compliance was assessed as average, and seven issues recurred:

1. no documented, up-to-date internal procedure for erasure requests;
2. missing or inadequate staff training;
3. insufficient information to individuals about the right;
4. misuse of, and uncertainty about, the exceptions used to refuse requests;
5. difficulty defining and applying retention periods;
6. deletion of data in backups;
7. ineffective anonymisation used instead of deletion.

Regulators can also act without a request: in Újpest (C-46/23, 14 March 2024) the Court of Justice held that a supervisory authority may order the erasure of unlawfully processed data on its own initiative, whether the data came from the person or another source.

A procedure you can adopt

1. Log the request with the date received, and verify identity only where in doubt.
2. Locate the data using your records of processing: systems, processors, backups, exports.
3. Decide for each data set: a ground under Article 17(1)? An exception under 17(3)? Involve legal or compliance staff in refusals and partial refusals, as the EDPB recommends.
4. Delete using a secure method, instruct processors, and note backups for re-deletion on restore.
5. Notify recipients under Article 19, and other controllers under 17(2) if the data was made public.
6. Reply within one month: what was deleted, what was kept, on which exception and until when, and the right to complain.
7. Keep evidence that erasure was carried out, as the EDPB recommends, without keeping the erased data itself.

Set your retention periods first: most erasure requests are much easier when data you no longer need has already gone. Access requests follow similar rules; see our DSAR guide.

Know where the data is before the request arrives. The GDPR Records of Processing (RoPA) Kit includes controller and processor RoPA templates with retention fields and a data inventory workbook, the map you search when a request comes in.

Sources

• Regulation (EU) 2016/679 (GDPR), Articles 12, 17, 18, 19, 21 and 28(3) and recital 65, EUR-Lex
• EDPB, 2025 Coordinated Enforcement Action: implementation of the right to erasure by controllers, report adopted 10 February 2026
• Court of Justice, Google v CNIL, C-507/17, 24 September 2019, EUR-Lex
• Court of Justice, Újpest, C-46/23, 14 March 2024, EUR-Lex

Related tools