Erasure and restriction answer the same complaint in two different ways: “stop using my data”. Erasure removes it. Restriction freezes it. Choosing the right one, and honouring it in practice, is where most organisations go wrong.
Erasure: grounds first, exceptions second
A person can require erasure where a ground in Article 17(1) applies:
- the data is no longer necessary for its purpose;
- consent is withdrawn and there is no other basis;
- the person objects and there is no overriding ground, or the processing is direct marketing;
- the processing is unlawful;
- erasure is required by law;
- the data was collected from a child for an online service;
- since 2026-03-31, the data was processed because of an allegation by a “malicious person”, meaning someone convicted of stalking or harassment against the data subject or subject to a stalking protection order protecting them.
Then check the exceptions in Article 17(3): freedom of expression, a legal obligation or public task, public health, archiving or research where erasure would seriously impair it, and legal claims. Each is a test, not a shield. Record which one applies and why.
Restriction: the pause button
Restriction applies where the person contests accuracy (while you check), where processing is unlawful but they want restriction instead of erasure, where you no longer need the data but they need it for a legal claim, or where they have objected and you are deciding whether your grounds override theirs.
While restricted, data can be stored but not otherwise used, except with consent, for legal claims, to protect someone else’s rights, or for important public interest. You must tell the person before lifting it.
Restriction is the right answer far more often than organisations realise. A dispute about accuracy is best met with “we have restricted it while we check” than with silence.
Making it real in systems
| Problem | Practical answer |
|---|---|
| Copies everywhere | Map where the data lives before you need to erase it: the record of processing should say |
| Backups | Put data in backups beyond use and make sure it is not restored to live systems |
| Logs and analytics | Pseudonymise or age out; erasure need not mean deleting every log line |
| Shared with others | Tell recipients (Art 19), and if you made it public take reasonable steps to tell other controllersControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. (Art 17(2)) |
| Suppression | Keep the minimum needed to stop re-contact; suppression is not a breach of erasure |
The criminal edge
If a subject access requestSubject access requestPractitioner shorthand for exercising the right of access. Not a statutory phrase, and no particular form or wording is required to make one. from the same person is open, erasing the data before answering it can be the s.173 offence: altering or destroying records to prevent disclosure. Answer the access request first, or keep a copy for the response.
For a complaint
State the ground, not just the wish. “Please delete my data” invites a template reply; “the data is no longer necessary for the purpose you collected it for, which was my 2021 order” requires an answer.