What is the right to erasure, and when does it apply?

What it is

Erasure means deleting the data, or putting it beyond use. Where you made the data public, you must take reasonable steps to tell other controllers to erase links and copies. From 2026-03-31 there is a further ground for data processed because of an allegation by a person later convicted of stalking or harassment.

When it applies

• The data is no longer necessary for its purpose. UK GDPR Art 17(1)(a)
• Consent is withdrawn and there is no other basis. Art 17(1)(b)
• The person objects and there are no overriding grounds, or objects to direct marketing. Art 17(1)(c)
• The processing is unlawful, or erasure is needed to meet a legal obligation. Art 17(1)(d), (e)
• The data was collected from a child for an online service. Art 17(1)(f)
• The data was processed because of an allegation by a person convicted of stalking or harassment, from 2026-03-31. Art 17(1)(g); SI 2026/317

When it does not apply

• Processing needed for freedom of expression, a legal obligation or a public task, public health, archiving or research, or legal claims. Art 17(3)

Who is responsible

The controller, which must also tell recipients unless impossible or disproportionate.

What it involves

1. Identify the ground.
2. Check the exceptions.
3. Erase from live systems and put backups beyond use.
4. Tell recipients.
5. Respond within one month.

Timing

One month, extendable by two.

If it goes wrong

Regulatory

Failing to respond properly breaches Arts 12 to 22. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Most cases start with a complaint to the regulator, which can order compliance.

Criminal

No offence.

Civil

The person can apply to court for a compliance order (DPA 2018 s.167) and claim compensation for damage or distress (Art 82; s.168).