--- title: GDPR Article 17 – Right to Erasure ("Right to be Forgotten") slug: gdpr-art-17-right-to-erasure topic: data-protection lang: en valid_from: 2018-05-25 valid_to: null last_reviewed: 2026-05-28 status: current authority_level: A license: CC-BY-4.0 url: https://nexvyra.de/en/fakten/gdpr-art-17-right-to-erasure.md wikidata_subjects: [Q1172506, Q2961237] de_version: https://nexvyra.de/fakten/dsgvo-loeschungsrecht-art-17.html --- # GDPR Article 17 – Right to Erasure ("Right to be Forgotten") ## Short answer Under Article 17 of the General Data Protection Regulation (GDPR), any data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, where **one** of the six grounds listed in Art. 17(1) lit. a–f applies — for instance, the data is no longer necessary for the original purposes, consent has been withdrawn, or the processing is unlawful. If the controller has made the data public, they must additionally, under Art. 17(2), take reasonable steps to inform other controllers processing that data of the erasure request ("right to be forgotten"). The response deadline is **one month** under Art. 12(3), extendable by up to **two further months**. Art. 17(3) lists five exhaustive exceptions where the right does not apply. ## Key facts | Item | Value | |---|---| | Legal basis | Regulation (EU) 2016/679, Article 17 | | Right holder | any natural person whose data is being processed | | Right addressee | controller as defined in Art. 4(7) GDPR | | Response deadline (Art. 12(3)) | 1 month from receipt of the request | | Extension | up to 2 additional months for complex or numerous requests | | Notification of extension | within the first month, including reasons | | Erasure grounds (paragraph 1) | 6 grounds (lit. a–f), only one must apply | | Duty to inform third parties (paragraph 2) | for data made public: reasonable steps to inform other controllers | | Exceptions (paragraph 3) | 5 exhaustive grounds (lit. a–e) | | Justification by requester | not required | | Cost | generally free of charge (Art. 12(5)) | | Consequences of unlawful refusal | complaint to DPA (Art. 77), damages (Art. 82), fine up to €20 million or 4 % of global annual turnover (Art. 83(5)(b)) | ## Grounds for erasure (Art. 17(1) lit. a–f) The data subject can request erasure if **any** of the following applies: - **(a)** Personal data is no longer necessary for the purposes for which it was collected or otherwise processed. - **(b)** The data subject withdraws consent on which processing was based under Art. 6(1)(a) or Art. 9(2)(a), and no other legal basis exists. - **(c)** The data subject objects under Art. 21(1) and there are no overriding legitimate grounds for processing, or objects under Art. 21(2) to direct marketing. - **(d)** The personal data has been unlawfully processed. - **(e)** Erasure is required for compliance with a legal obligation under Union or Member State law to which the controller is subject. - **(f)** The personal data was collected in relation to information society services offered under Art. 8(1) (children under 16). ## Duty to inform third parties (Art. 17(2) – "right to be forgotten") Where the controller has made the personal data **public** and is obliged under paragraph 1 to erase it, they must take **reasonable steps**, including technical measures, taking into account available technology and implementation costs, to inform other controllers processing that data that the data subject has requested erasure of **any links to, or copy or replication of, that data**. This is the core of the so-called "right to be forgotten". For search engines, the European Data Protection Board (EDPB) has detailed the criteria for delisting requests in its **Guidelines 5/2019**. ## Exceptions to the right of erasure (Art. 17(3) lit. a–e) The right of erasure under paragraphs 1 and 2 does **not** apply to the extent processing is necessary: - **(a)** for exercising the right of freedom of expression and information; - **(b)** for compliance with a legal obligation (e.g., commercial or tax retention obligations) or for the performance of a task carried out in the public interest or in the exercise of official authority; - **(c)** for reasons of public interest in the area of public health under Art. 9(2)(h)–(i) and Art. 9(3); - **(d)** for archiving purposes in the public interest, scientific or historical research, or statistical purposes under Art. 89(1), insofar as erasure is likely to render impossible or seriously impair achievement of those purposes; - **(e)** for the establishment, exercise, or defence of legal claims. This list is **exhaustive**. Other interests of the controller (e.g., marketing, efficiency) are not valid grounds for exception. ## Form, deadline, and consequences The erasure request is **form-free** under Art. 12 GDPR (written, e-mail, oral) and requires **no justification**. The controller must respond "without undue delay and in any event within one month" (Art. 12(3)); this period can be extended by up to two months for complex or numerous requests — the extension and its reasons must be communicated within the first month. If wrongfully refused, the data subject can lodge a complaint with the competent supervisory authority (Art. 77), claim damages (Art. 82), and the controller can be fined up to **€20 million or 4 % of global annual turnover** of the preceding financial year (Art. 83(5)(b)). ## Relationship with statutory retention obligations Where statutory retention obligations exist (e.g., German **§ 257 HGB**, **§ 147 AO** — 6 or 10 years for accounting documents, commercial books, tax records), the exception under Art. 17(3)(b) applies: the data may, or must, be retained. In such cases, **restriction of processing** under Art. 18 GDPR is recommended — the data is blocked and used only for the statutory purpose until the retention period expires and final erasure becomes possible. ## Sources - Regulation (EU) 2016/679 – GDPR full text (EUR-Lex, English): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 - BfDI (German Federal Commissioner) – Right to Erasure ("Right to be Forgotten"), in German: https://www.bfdi.bund.de/DE/Buerger/Inhalte/Allgemein/Betroffenenrechte/Betroffenenrechte_Loeschung_Vergessenwerden.html - German DSK – Short Paper No. 11 "Right to Erasure / Right to be Forgotten", in German: https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_11.pdf - EDPB – Guidelines 5/2019 on the criteria of the Right to be Forgotten in search engines under the GDPR: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation_en.pdf ## German version - [DSGVO Art. 17 – Recht auf Löschung („Recht auf Vergessenwerden")](https://nexvyra.de/fakten/dsgvo-loeschungsrecht-art-17.html) ## Status - Last reviewed: 2026-05-28 - Valid from: 2018-05-25 (entry into force of GDPR) - Status: current - Source authority: A (EUR-Lex, BfDI, DSK, EDPB) - License: CC BY 4.0