Article 17 and Recitals 65 & 66 of the Applied GDPR relate to this right, which is also referred to as “the right to be forgotten”. This right includes an entitlement for individuals to ask to be given details of the recipients to whom the controller has disclosed the personal data which is the subject of the request for erasure.

Although individuals have the right to obtain erasure of their personal data without undue delay on request, the right is not absolute and controllers are only obliged to erase personal data in the circumstances specified in Article 17(1). 

The right can be exercised when one of the following applies:

or the data:

Action to be taken by controllers

Limitations and restrictions

There are limitations on the extent of the exercise of the right set out in Article 17(3) of the Applied GDPR if the processing is necessary:

Refusing a request

Controllers may refuse to comply with all or part of the request for erasure but must be able to justify its decision.

Requests may be refused in cases where:

Non-compliance with requests to exercise rights

If the controller is not taking action on the request of the individual to exercise any right, it must inform the individual “without delay” (and within ONE month of receipt of the request) about: