What is the right to be forgotten in GDPR?

The right to be forgotten is the right to request erasure of personal data under Article 17. As explained in the EDPB’s guidance on erasure, it applies in circumstances including:

• Data is no longer needed or was processed unlawfully.

• Consent is withdrawn and no other lawful basis remains.

• An objection succeeds, including an objection to direct marketing.

• Deletion is legally required, or the data was collected through consent-based online services offered to a child.

The right is not absolute. Necessary retention may continue for legal obligations, legal claims, freedom of expression or qualifying public-interest, public-health, research and archiving purposes.

The data controller must act without undue delay and respond within one month. It may extend the response period by two further months where necessary because of complexity or the number of requests, but must explain the extension within the first month.

Where applicable, it must also notify recipients of the erasure and take reasonable steps concerning publicly disclosed copies or links.