The right to erasure obliges controllers to erase personal data without undue delay where one of the statutory grounds for erasure applies.
When data must be erased
- the purpose of the processing no longer applies
- the data subject has withdrawn their consent
- they have validly objected
- the data has been processed unlawfully
- a legal obligation requires erasure
The obligation to erase also exists without a request. The right is often referred to as the right to be forgotten, a term shaped by the CJEU judgment of 13 May 2014 (C-131/12, Google Spain).
Exceptions
Data does not have to be erased where the processing is necessary, for example, to comply with statutory retention obligations, to exercise the right of freedom of expression or to establish legal claims. In that case, the data must be blocked and erased once the period has expired.
Erasure means that the data can no longer be restored. Moving it to a recycle bin is not sufficient.
Legal provisions
- Art. 17 GDPR
- Right to erasure and exceptions.
- Art. 19 GDPR
- Notification of erasure to recipients.
- Section 35 BDSG
- Restriction of processing instead of erasure in certain cases.
Related terms.
Deletion concept A deletion concept sets out in a binding manner which personal data is deleted when, how and by whom. Art. 5(1)(e) GDPR 
Retention period / storage limitation The principle of storage limitation requires personal data to be kept in a form which permits identification for no longer than is necessary for the purpose of the processing. Art. 5(1)(e) GDPR Right of access The right of access entitles every person to obtain confirmation from a controller as to whether, and which, personal data concerning them is being processed. Art. 15 GDPR Right to rectification The right to rectification entitles every person to have inaccurate personal data rectified without undue delay and incomplete data completed. Art. 16 GDPR
All terms from A to Z Retention period / storage limitation The principle of storage limitation requires personal data to be kept in a form which permits identification for no longer than is necessary for the purpose of the processing. Art. 5(1)(e) GDPR Right of access The right of access entitles every person to obtain confirmation from a controller as to whether, and which, personal data concerning them is being processed. Art. 15 GDPR Right to rectification The right to rectification entitles every person to have inaccurate personal data rectified without undue delay and incomplete data completed. Art. 16 GDPR 