Erasure
How to handle a request for erasure under UK GDPR Art 17: when a ground applies, when an exception lets you keep the data, and what to do about recipients, published data and backups. Includes the new malicious-allegation ground in force from 2026-03-31.
- Applies to
- Any controller under the UK GDPR. Part 3 (law enforcement) has its own erasure right in DPA 2018 s.47.
- Instruments
- UK GDPR, DPA 2018
- Steps
- 9 steps, with a deadline calculator.
Deadline calculator
Other data subject rights request
Rectification, erasure, restriction, portability, objection and automated decision requests: one calendar month from receipt, extendable by two further months for complex or numerous requests. Same counting as subject access.
Basis: UK GDPR Art 12(3) and Art 12A. Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.
Mechanics
| Item | Position |
|---|---|
| Deadline | One calendar month from receipt |
| Extension | Two further months for complex or numerous requests, notified within the first month |
| Stop the clock | While reasonably waiting for identity or clarification (Art 12A) |
| Cost | Free; a reasonable fee or refusal only if manifestly unfounded or excessive |
| New ground | Art 17(1)(g): data processed because of an allegation by a malicious person, in force 2026-03-31 |
Steps
-
Check a ground applies
A ground under Art 17(1): the data is no longer necessary; consent is withdrawn and there is no other basis; the person objects and there are no overriding legitimate grounds (or it is direct marketing); the processing is unlawful; erasure is legally required; the data was collected from a child for an online service; or, from 2026-03-31, it was processed because of an unfounded allegation by a person convicted of stalking or harassment against them, or subject to a stalking protection order.
See UK GDPR
-
Check whether an exception applies
The right does not apply to the extent processing is necessary for freedom of expression, a legal obligation or public task, public health, archiving, research or statistics where erasure would seriously impair it, or the establishment, exercise or defence of legal claims (Art 17(3)). Apply each by its test and record it.
See UK GDPR
-
Erase everywhere it is held
Erase from live systems and copies. For backups that cannot be selectively erased, put the data beyond use and make sure it is not restored into live systems.
See UK GDPR
If a subject access request from the same person is open, answer it before erasing, or keep a copy of what you erase for the response. Destroying data to stop it being disclosed in response to an access request is an offence under DPA 2018 s.173. -
Tell others if you made the data public
If you made the data public, take reasonable steps, considering cost and technology, to tell other controllers processing it that the person has asked for erasure (Art 17(2)).
See UK GDPR
-
Tell recipients
Tell each recipient about the erasure unless impossible or disproportionate (Art 19).
See UK GDPR
-
Refuse only with reasons
If you do not act, tell the person within the deadline why, and that they can complain to you, then to the Information Commission, and seek a judicial remedy. Manifestly unfounded or excessive requests may be refused, but you must be able to show why.
See UK GDPR
-
Handle any complaint
A dissatisfied requester complains to you first under your s.164A process (complaints received from 2026-06-19), then to the Information Commission.
See DPA 2018
Checklists and tools for this procedure
Explainers
Sources
- Primary UK GDPR (Regulation (EU) 2016/679 as it applies in the UK) legislation.gov.uk
- Primary UK GDPR Article 12 legislation.gov.uk
- Primary Victims and Prisoners Act 2024 (Commencement No. 10) and Data (Use and Access) Act 2025 (Commencement No. 8) Regulations 2026 (SI 2026/317) legislation.gov.uk
- Primary Data Protection Act 2018, section 173 legislation.gov.uk