AI & Human Authenticity
What Is the GDPR Right to Be Forgotten? Rules and Deadlines
HAR Editorial Team
You sent a company your name, photos, or account details, and now you want them gone. Or you run a business and just received a deletion request with a clock ticking. Either way, GDPR the right to be...
What Is the GDPR Right to Be Forgotten? Rules and Deadlines
You sent a company your name, photos, or account details, and now you want them gone. Or you run a business and just received a deletion request with a clock ticking. Either way, GDPR the right to be forgotten is the rule that decides what happens next, and the details matter.
Here is the short answer. Under Article 17 of the GDPR, also called the right to erasure, you can ask an organization to delete your personal data when it no longer needs it, when you withdraw consent, or when it processed the data unlawfully. The organization must respond within one month, which most people call 30 days. It can refuse in limited cases, such as legal obligations, public interest, or defending legal claims.
Below, we break down when the right applies, how deadlines are counted, which exceptions hold up, and how backups and employee data are treated. At the Human Authenticity Registry, deletion on request is part of our consent-first approach, so we care about getting this right in practice, not only on paper.
Why the right to be forgotten matters
A legal right to take your data back
The right that allows individuals to request deletion of their data is Article 17 of the GDPR. It works in three steps. You send a request to the organization holding your data. The organization checks whether a legal ground applies and whether an exception blocks it. Then it either erases the data or explains why it won't. That is how the right to be forgotten works in practice. It is a right to request deletion of personal data, not an automatic delete button.
Under the GDPR, deleting your data is not a favor a company may grant. It is a duty the company must justify refusing.
The idea predates the regulation. In 2014, the Court of Justice of the EU ruled in the Google Spain case that people can ask search engines to delist outdated or irrelevant results about them. The GDPR, enforceable since May 25, 2018, widened that principle to any organization handling the personal data of people in the EU. The UK kept the rule after Brexit, so the right to be forgotten in the UK works almost the same way under the UK GDPR and the Data Protection Act 2018.
Why individuals rely on it
Personal data piles up quietly. You sign up, you stop using the service, and your details stay on someone's server for years. Each copy is a future risk, whether from a breach, a resale, or a use you never agreed to.
These are the situations where erasure requests make the biggest difference:
A forum or shopping account from 2011 still holds your email, address, and purchase history.
A data broker lists your phone number and home address for anyone to buy.
A company keeps your job application and ID scan long after the hiring decision.
A service stores photos or face scans from an app you quit.
Faces and voices deserve extra attention. Once an image is copied into other systems, you cannot easily pull it back. Asking for deletion early is the most reliable way to limit that spread, and it is why deletion on request is built into how we run HAR.
Why organizations take it seriously
For a business, GDPR and the right to be forgotten is a compliance duty with real penalties. Failing to honor data subject rights can bring fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher. Most trouble starts smaller than that, with a complaint to a regulator after a request goes unanswered. Employees have the same right, so HR teams need a process too, even though some employment records must be kept under tax and labor laws.
Who | What is at stake |
|---|---|
Individuals | Control over old, inaccurate, or unwanted personal data |
Employees | Erasure of data no longer needed, within legal retention limits |
Organizations | Fines up to €20 million or 4% of turnover, plus regulator complaints and lost trust |
The takeaway is simple. The right protects people from data that outlives its purpose, and it pushes organizations to collect less, keep it for shorter periods, and know where every record lives.
When you can request erasure and when it can be refused
Six grounds that support a request
Article 17(1) lists the situations where a GDPR data deletion request must be honored. You only need one of them:
The data is no longer needed for the purpose it was collected.
You withdrew consent and no other legal basis applies.
You objected to the processing and no overriding legitimate interest exists. Objections to direct marketing always win.
The data was processed unlawfully.
A law requires the data to be erased.
The data was collected from a child for an online service.
Consent is the most common route. If you signed up on the basis of consent, withdrawing it should trigger deletion unless the organization has another lawful reason to keep the data. You do not need to cite an article number or fill out a special form. Plain language is enough, as long as it is clear you want your data erased.
Exceptions that justify a refusal
Refusals are narrower than many companies assume. Article 17(3) allows only these GDPR right to be forgotten exceptions:
Exercising freedom of expression and information.
Complying with a legal obligation, or performing a public interest task.
Protecting public health.
Archiving, scientific or historical research, or statistics, where erasure would seriously impair the goal.
Establishing, exercising, or defending legal claims.
A company can refuse erasure only with a named legal reason, never because deletion is inconvenient.
In practice, the legal-obligation exception is the one you will meet most. A retailer may have to keep invoices for tax purposes, and an employer may have to keep payroll records. That covers those records only. Your marketing profile, browsing history, and old support chats should still go. If the organization refuses, it must tell you why, and you can complain to your regulator (the ICO in the UK) or go to court.
How to make or handle a deletion request step by step
Whichever side you are on, GDPR the right to be forgotten comes down to a simple sequence. A GDPR request for data deletion is a short written message on one side and a documented process on the other. Here is the practical version for each role.
Making a request as an individual
Start with the privacy contact listed in the company's privacy policy. If there is no dedicated address, use general support. Always send it in writing, because you need a dated record if the company goes quiet.
Identify the organization and every account, email address, or phone number tied to your data.
State plainly that you want your personal data erased under Article 17.
Name the ground, such as withdrawn consent or data no longer needed.
Offer to verify your identity through the account email instead of sending ID documents.
Note the send date and set a reminder for one month later.
Keep the message short. A clear request with one ground beats a long legal essay, and no special form is required. Employees can use the same route. Send it to HR or the data protection officer, and expect the employer to keep payroll and tax records while erasing the rest.
Handling a request as an organization
Treat every request as live from the moment it arrives, whatever the channel. A request sent to a social media account or a manager's inbox still counts, and the clock runs from that day.
Log the date received and assign an owner.
Verify identity with the minimum information needed. Ask for more only when you have real doubt.
Search every system, including your CRM, email, analytics, backups, and processors.
Decide whether a ground applies and whether an Article 17(3) exception blocks it. Partial erasure is allowed.
Delete the data, then tell processors and other recipients to do the same. If you made the data public, take reasonable steps to have other controllers remove it too.
Confirm to the requester in writing. If you refused any part, give the reason and explain their right to complain to the regulator.
A well-handled request is answered on time, deleted completely, and documented clearly.
Finally, keep a simple log of what you received, what you decided, and why. Regulators ask for this evidence first when a complaint arrives, and it makes the next request much faster to process.
Deadlines, backups and other tricky situations
How the deadline is counted
The standard GDPR data deletion request time is one calendar month from receipt, which is why people talk about a GDPR right to be forgotten 30 days rule. It is not exactly 30 days. A request received on January 15 is due by February 15. If the organization has reasonable doubt about who you are, the clock starts once it has verified your identity, but only if it asked without delay.
Complex or numerous requests can be extended by two further months. The organization must tell you about the extension, and the reason, within the first month. If you hear nothing, you can complain to the regulator.
One month is the default, and any extension needs a stated reason before that month runs out.
What happens to backups
The right to be forgotten under GDPR and backups is a common sticking point. Regulators accept that an organization cannot always edit an archive the moment you ask. They do expect a clear approach:
Delete the data from live systems right away.
Put the backup copy beyond use, meaning no one accesses it or restores it for any purpose.
Let it expire on the normal rotation, and re-delete it if a restore ever happens.
Tell you how long the backup cycle lasts.
A backup is not a loophole. Keeping your data in an archive indefinitely and calling it "technical" will not hold up in a complaint.
Other situations that cause confusion
Edge cases are where most disputes start. Here is how the common ones usually play out.
Situation | What to expect |
|---|---|
Employee request | Payroll, tax, and pension records stay. Performance notes and old application data can go, unless a dispute is open. |
Data shared with processors | The organization must pass the request on to each processor and recipient. |
Data made public | The organization must take reasonable steps to have other controllers remove it. |
Repeated or abusive requests | A manifestly unfounded or excessive request can be refused or charged a reasonable fee. The organization must prove it. |
Keep in mind that partial erasure is normal. An organization may delete most of your data while retaining one narrow category it is legally required to keep, as long as it tells you exactly which category and why.
Examples and a sample erasure request template
Theory only gets you so far. Seeing how real requests play out makes it easier to write a clear request or to judge one you received.
Three common scenarios
Most requests follow a few patterns. The table below shows how GDPR and the right to be forgotten usually works when an organization applies Article 17 correctly.
Scenario | What you ask for | Likely outcome |
|---|---|---|
Old shopping account | Delete the account, purchase history, and marketing profile | Erased, except invoices kept for tax |
Former employee | Delete application notes and performance reviews | Payroll and pension records stay, the rest goes unless a dispute is open |
Photo app you quit | Withdraw consent, delete photos and face scans | Full erasure, plus notice to processors |
In each case, the organization keeps only what a law requires and deletes the rest within one month. The same logic applies to the right to be forgotten in the UK, so a narrow, documented exception is fine while a blanket refusal is not.
A copy-and-paste erasure request template
Copy the message below and fill in the brackets. It works for any right to be forgotten GDPR request, whether you write as a customer or as an employee, and it keeps the legal ground front and center.
Before you send it, delete the lines that do not apply and save a copy with the send date. If the company asks for proof of identity, offer to confirm through the account email first, since less intrusive verification is what the law expects.
A good erasure request names the data, the ground, and the date.
Organizations can flip this template into a reply checklist. Confirm what was erased, name anything retained with its legal reason, and point the person to the regulator.
Keeping control of your personal data
The GDPR right to be forgotten comes down to one idea: your data should not outlive its purpose. You can ask for erasure in plain language, the organization has one month to answer, and it can refuse only with a named legal reason. Backups, employee records, and partial erasure all follow that same logic.
Whether you are sending a request or answering one, keep a dated record and stay specific. A clear message and a documented reply settle most disputes before they ever reach a regulator.
If you want a say in how your identity is treated as AI spreads, consider joining a registry built on consent and deletion on request. You can register with the Human Authenticity Registry in 5 to 10 minutes from your smartphone and become a Founding Member of a consent-first community.