What is the right to be forgotten under GDPR?

What is the right to be forgotten under GDPR?

The right to be forgotten is the right to erasure under Article 17. It allows individuals to require deletion of personal data when specified legal grounds apply.

These include situations where:

• The information is no longer needed for its original purpose.

• Consent is withdrawn and no other lawful basis supports continued processing.

• The data was processed unlawfully.

• An objection requires the processing to stop.

• Deletion is necessary to meet a legal obligation.

The right is not absolute. Organisations may retain information where necessary to meet legal obligations, handle legal claims or protect freedom of expression. For example, tax rules may require certain transaction records to be kept after an account is closed.

A data deletion request must therefore be assessed against the relevant grounds and data retention requirements. Where erasure is required, the organisation must act without undue delay.