← GDPR · Data subject rights

Art.17 — Right to erasure (“right to be forgotten”)

high data-subject-rightsdata-deletion

Requirement

Data subjects have the right to erasure without undue delay where an Article 17(1) ground applies — for example the data is no longer necessary, consent is withdrawn, an objection is upheld or processing is unlawful — subject to the Article 17(3) exceptions such as legal obligations to retain; where data was made public, reasonable steps must be taken to inform other controllers.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of
erasureright to be forgottendeletedeletionerase
Required element 2 — any one of
requestprocedurewithout undue delayone monthwithdrawno longer necessaryaskasks us30 dayson request
Supporting terms — specificity signals
article 17backupsdownstreamprocessorsconfirm deletionlegal obligation to retainexceptionmade public
Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

cannot delete user data deletion is not supported we never delete

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

FrameworkControlTitleShared topics
CCPA/CPRA 1798.105 Right to delete data-subject-rights data-deletion
NDPA 2023 s.34(1)(d)-(e) Right to erasure and restriction data-subject-rights data-deletion
COPPA 312.6 Parents may review, delete and refuse further collection data-subject-rights data-deletion
CCPA/CPRA 1798.106 Right to correct data-subject-rights
CCPA/CPRA 1798.110 & 1798.115 Right to know and access data-subject-rights
CCPA/CPRA 1798.125 Non-discrimination and financial incentives data-subject-rights
CCPA/CPRA 1798.130(a)(1)-(2) Methods for requests and 45-day response data-subject-rights
CCPA/CPRA Regs (ADMT) Automated decision-making technology for significant decisions data-subject-rights