What are the grounds for erasure under GDPR Art. 17?

Six grounds (lit. a–f): data no longer necessary; consent withdrawn without alternative legal basis; objection under Art. 21 with no overriding interest; unlawful processing; legal obligation to erase; data collected from a child under 16 for information society services. Only one must apply.

When does the right to erasure NOT apply?

Art. 17(3) lists five exhaustive exceptions: freedom of expression and information; compliance with legal obligation; public-interest tasks; reasons of public interest in public health; archiving in the public interest, scientific/historical research, or statistical purposes; establishment, exercise, or defence of legal claims.

What are the consequences of wrongfully refusing an erasure request?

The data subject can lodge a complaint with a supervisory authority (Art. 77), claim damages (Art. 82), and the controller can be fined up to €20 million or 4 % of global annual turnover (Art. 83(5)(b)).

GDPR Article 17 – Right to Erasure ("Right to be Forgotten")

Q: What is the 'right to be forgotten' specifically?

Art. 17(2) GDPR: where a controller has made the data public and is obliged to erase it, they must take reasonable steps to inform other controllers processing that data that the data subject has requested erasure of any links, copies, or replications. The EDPB Guidelines 5/2019 detail this for search engines.

Machine-readable version: /en/fakten/gdpr-art-17-right-to-erasure.md · German version: DE

GDPR Data Protection EU Law Article 17 Right to be Forgotten

Short answer Under Article 17 GDPR, a data subject can demand erasure of their personal data if any of six grounds applies (Art. 17(1) lit. a–f). If the controller has made the data public, they must additionally take reasonable steps to inform other controllers (Art. 17(2) — the actual "right to be forgotten"). Response deadline: one month (Art. 12(3)), extendable by 2 months. Art. 17(3) lists five exhaustive exceptions.

Key facts

Item	Value
Legal basis	Regulation (EU) 2016/679, Article 17
Erasure grounds	6 (Art. 17(1) lit. a–f); one must apply
Exceptions	5 (Art. 17(3) lit. a–e); exhaustive
Response deadline	1 month (Art. 12(3))
Extension	up to 2 additional months
Cost	free
Justification	not required
Max fine	€20 million or 4 % global turnover (Art. 83(5)(b))

Grounds for erasure (Art. 17(1) lit. a–f)

Any one of the following triggers the right:

(a) data no longer necessary for the original purposes
(b) consent withdrawn, no other legal basis
(c) objection under Art. 21(1) without overriding interest, or Art. 21(2) direct marketing objection
(d) unlawful processing
(e) legal obligation under Union or Member State law
(f) data collected from a child under 16 for information society services (Art. 8(1))

Duty to inform third parties (Art. 17(2) — "right to be forgotten")

Where the controller has made the personal data public and is obliged to erase it under paragraph 1, they must take reasonable steps — including technical measures, taking available technology and implementation costs into account — to inform other controllers processing that data that the data subject has requested erasure of any links, copies, or replications. This is the core of the so-called "right to be forgotten". For search engines, the EDPB Guidelines 5/2019 detail the criteria for delisting requests.

Exceptions (Art. 17(3) lit. a–e)

The right to erasure does not apply where processing is necessary:

(a) for exercising freedom of expression and information
(b) for compliance with a legal obligation (e.g., commercial/tax retention) or a public-interest task
(c) for reasons of public interest in public health (Art. 9(2)(h)–(i), Art. 9(3))
(d) for archiving in the public interest, scientific or historical research, or statistical purposes (Art. 89(1))
(e) for the establishment, exercise, or defence of legal claims

This list is exhaustive — other controller interests (marketing, efficiency) are not valid grounds.

Statutory retention obligations

Where retention obligations exist (e.g., German § 257 HGB, § 147 AO — 6 or 10 years for accounting/tax records), Art. 17(3)(b) applies: the data must be retained. In such cases, restriction of processing under Art. 18 GDPR is recommended — the data is blocked and used only for the statutory purpose until retention expires and final erasure becomes possible.

Sources

Regulation (EU) 2016/679 – GDPR full text (EUR-Lex): eur-lex.europa.eu
BfDI – Right to Erasure (in German): bfdi.bund.de
EDPB Guidelines 5/2019 on the Right to be Forgotten in search engines: edpb.europa.eu

Last reviewed:: 2026-05-28
Valid from:: 2018-05-25 (entry into force of GDPR)
Status:: current
Source authority:: A (EUR-Lex, BfDI, DSK, EDPB)
License:: CC BY 4.0

Translation of the German original. The German version is binding and updated daily by the fact-check agent. In case of doubt, refer to the German version.