Right to Be Forgotten: GDPR Article 17 Explained

The right to be forgotten is your right under GDPR to have an organisation erase personal data about you. Article 17 GDPR calls it the "right to erasure". It applies in specific situations, for example when the data is no longer needed, when you withdraw consent, or when the data was processed unlawfully. It is not absolute: freedom of expression, legal obligations, public health and legal claims can override it. Organisations must normally respond within one month.

An everyday example

A former patient of "Example Dental Practice" (a made-up example) moved abroad three years ago. She asks the practice to delete everything it holds about her, and to stop sending reminders.

The practice can stop the reminders and delete the marketing data straight away: it relied on her consent and she has withdrawn it. But the treatment records are different. National law requires dental records to be kept for a set number of years, and that legal obligation is an exception to erasure. So the practice deletes what it can, keeps what the law requires, and writes back within a month explaining which data stays and why.

The details, simply

Where the name comes from

The phrase became famous through the Google Spain case (C-131/12). On 13 May 2014, the Court of Justice of the EU ruled that a Spanish man, Mario Costeja González, could ask Google to remove search results for his name that linked to 1998 newspaper notices of a property auction over his social security debts, even though the newspaper's publication itself was lawful. That ruling was made under the old Data Protection Directive. GDPR, applicable since 2018, then wrote the right into Article 17 with the heading "Right to erasure ('right to be forgotten')".

When you can ask for erasure (Art. 17(1))

An organisation must erase personal data without undue delay where one of these applies:

The data is no longer necessary for the purpose it was collected for.
You withdraw consent and there is no other legal ground.
You object to the processing and there are no overriding legitimate grounds, or you object to direct marketing.
The data has been processed unlawfully.
Erasure is required by a legal obligation.
The data was collected when offering online services to a child.

If the organisation has made the data public, it must also take reasonable steps to tell other controllers processing it that you have asked for erasure of links and copies (Art. 17(2)).

The exceptions (Art. 17(3))

Erasure does not apply where processing is necessary:

for freedom of expression and information;
to comply with a legal obligation or for a task in the public interest;
for public health reasons;
for archiving, research or statistics in the public interest, where erasure would seriously impair that purpose;
for the establishment, exercise or defence of legal claims.

That is why a doctor's treatment records or a lawyer's case files are often kept despite a request: retention duties and potential legal claims usually win.

How fast, and at what cost (Art. 12)

The organisation must act without undue delay and within one month of receiving the request. It can extend that by two further months for complex or numerous requests, but must tell you within the first month and explain why. The request is normally free. If it refuses, it must say why and tell you that you can complain to the data protection authority.

In the UK, the ICO notes that erasure generally covers backups too, though backup data can be put "beyond use" until it is overwritten.

Sanctions

Breaches of data subject rights, including Article 17, fall in GDPR's higher fine tier: up to €20 million or 4% of worldwide annual turnover. More on that in GDPR fines.

This is general information, not legal advice.

What it does not protect

The right to be forgotten only reaches personal data. Once data has been anonymised, it is no longer about an identifiable person (GDPR Recital 26), and Article 17 no longer applies to it. You cannot ask for anonymised records to be erased, because legally they are not yours any more.

That matters because erasure and anonymisation often happen together. Many terms of service allow a provider, when you delete your account, to keep "aggregated or de-identified" data. Your name goes; the content can stay and can lawfully be pooled, licensed or sold. We show how that works on the data trail, with sources on legal to sell.

And if the data was only pseudonymised, it is still personal data, and the right still applies. See pseudonymisation vs anonymisation.

The AI problem: you cannot easily delete from a model

Deleting a file from a database is simple. Deleting what a trained AI model learned from that file is not. Once text has gone into training, it is spread across billions of model parameters. Retraining a large model without one person's data is expensive, and research into "machine unlearning" is still developing.

The European Data Protection Board said in its Opinion 28/2024 (December 2024) that AI models trained on personal data cannot always be considered anonymous: personal data can sometimes be extracted from them. So data inside a model may still be personal data, while being very hard to erase.

The practical lesson: the easiest way to honour the right to be forgotten is to make sure your clients' and patients' data never goes into training in the first place.

What this means when you use AI tools

Before you put personal data into an AI tool, check:

Training: is your content used to train models, by the tool or the model provider behind it?
Retention: how long are prompts, files and outputs kept, including logs and backups?
Deletion: when you delete a chat or a document, is it gone, or is a de-identified copy kept?
Licence: do the terms grant the provider a right to reuse or anonymise your content?
Your role: as controller, can you actually fulfil an erasure request within a month with this tool?

With Wysor, those answers are simple. We never train on your content and never sell it, anonymised or not. We take no licence to reuse it and act only as your processor under Art. 28 GDPR, on your instructions. Every connected AI model provider runs with zero data retention: processed, then deleted. Data is encrypted in transit and at rest and hosted in the EU, and the commitments are in the contract, binding anyone who could ever own Wysor.

FAQ

What is the right to be forgotten? It is the right under Article 17 GDPR to have your personal data erased in certain situations, such as when it is no longer needed or was processed unlawfully. The official name is the right to erasure.

Is the right to be forgotten absolute? No. Organisations can refuse where they need the data for freedom of expression, a legal obligation, public health, research or legal claims. They must explain the refusal.

How long does a company have to delete my data? One month from receiving the request, extendable by two further months for complex cases, as long as you are told about the extension within the first month.

Can I ask Google to remove search results about me? Yes. Since the Google Spain ruling of 2014, you can ask search engines to delist results for your name that are inadequate, irrelevant or no longer relevant. The search engine weighs your request against the public interest in the information.

Can personal data be removed from an AI model? Not easily. Once data has been used to train a model, removing it usually means retraining or specialised techniques that are still developing. Choosing tools that never train on your content avoids the problem.