The right to erasure is powerful in the right circumstances, but it is not a universal right to have every record deleted.
Article 17 UK GDPR can require deletion where specified grounds apply - for example where data is no longer necessary, consent is withdrawn and no other basis exists, an objection succeeds, or processing is unlawful. The right is subject to important exceptions.
Organisations can retain personal data where processing remains necessary for legal obligations, legal claims and other protected purposes. Retention must still comply with the principles; “we keep everything forever” is not a valid approach.
Key points
- Erasure is conditional, not absolute.
- Identify the ground for erasure.
- The organisation should consider copies and recipients where the law requires.
- A live dispute or legal claim can justify retaining relevant evidence.
Common grounds for erasure
- The data is no longer necessary for the purpose collected.
- You withdraw consent and there is no other lawful basis.
- You successfully object and there are no overriding grounds.
- The data has been unlawfully processed.
- Erasure is required by a legal obligation.
Why an organisation may refuse
Exceptions can apply for freedom of expression/information, legal obligations/public tasks, public health, archiving/research/statistics in specified circumstances, and establishment/exercise/defence of legal claims. The controller should identify the actual reason rather than replying simply that “GDPR requires us to retain records”.
Erasure versus restriction
If you need the record preserved for a legal claim but do not want it actively used, restriction may be more suitable than erasure. Deleting evidence you later need can be counterproductive.
In practice
- State the legal/factual reason the data should no longer be kept.
- Do not request deletion of evidence you need for an ongoing dispute without considering the consequence.
- Ask for the retention rule relied upon if the organisation refuses.
What to do
A practical next-step plan
- Identify the data.
- Identify the erasure ground.
- Consider whether restriction is safer for disputed evidence.
- Send the request and keep proof.
- Challenge any refusal by addressing the stated exception.
Common traps
Things that often confuse the issue
- “Right to be forgotten” does not mean automatic deletion on demand.
- Legal retention requirements can override erasure.
- Deleting a live credit/debt record may not be appropriate if the underlying data is lawfully and accurately required.
Evidence worth keeping
Require a reasoned decision and ask about recipients.
If the controller agrees to erasure, ask whether relevant recipients/search systems/backups will be addressed in accordance with its obligations and technical processes. If it refuses, ask which continuing purpose, lawful basis or exception justifies retention and for how long.
Useful wording.
“I request erasure of [specific data]. My ground is [no longer necessary / consent withdrawn with no other basis / successful objection / unlawful processing / other]. If you refuse, please identify the continuing purpose and legal basis or exception relied upon, and explain the retention period.”
Erasure and rectification solve different problems.
If the problem is that a historic record is factually wrong, rectification may be the more appropriate right. If the record accurately describes a past event but you want it removed, erasure requires its own legal basis. If you need records preserved for a dispute or court claim, erasure may be actively contrary to your interests; restriction can sometimes be the better request.
Retention may still be justified for legal, regulatory or evidential reasons.
An organisation may need to keep some records to comply with a legal obligation, establish or defend legal claims, exercise freedom of expression/information or satisfy other statutory exceptions. Ending a contract therefore does not necessarily mean every invoice, complaint, fraud-prevention or legal record must immediately disappear.
| Weak request | Stronger request |
|---|---|
| “Delete everything you have about me.” | Identify the data/category and the erasure ground you say applies. |
| “I closed my account.” | Explain which data is no longer necessary and why continued retention is not justified. |
| “I withdraw consent.” | Identify processing actually based on consent; withdrawal does not erase processing based on another lawful basis. |
The right to erasure is conditional, not a general right to wipe a history.
You can ask for personal data to be erased, but the organisation must assess whether a legal ground for erasure applies and whether an exception permits or requires continued processing. Common grounds include data no longer being necessary for its original purpose, withdrawal of consent where there is no other lawful basis, a successful objection, unlawful processing, or a legal erasure obligation.
Official sources
Check the rules behind this guide
ConsumerWise explains these materials in plain English. Check the current official source where a deadline, rule about what the body can deal with or legal requirement may have changed.