GDPR Article 17: Your Right to Erasure
In the digital age, your personal data is constantly collected, stored, and shared. However, under the UK General Data Protection Regulation (UK GDPR), you are not powerless over your digital footprint. Article 17 of the UK GDPR grants individuals the "Right to Erasure"—frequently referred to as the "right to be forgotten." This fundamental privacy right empowers you to request that organizations delete your personal data when they no longer have a compelling or lawful reason to keep it. Whether you want to remove an old social media account, scrub your details from a marketing database, or erase information you handed over as a child, Article 17 provides a legal mechanism to reclaim your privacy.
When the right to erasure applies
The right to erasure is powerful, but it is not an absolute, blanket right to demand the deletion of any data at any time. A data controller is legally obligated to erase your personal information if one of the following specific circumstances applies:
The data is no longer necessary: The organization no longer needs the information for the original purpose they collected it for.
You withdraw consent: The organization was relying on your explicit consent to process the data, and you have chosen to revoke that consent.
You object to the processing: You object to the use of your data (especially in the case of direct marketing), and the organization cannot prove an overriding "legitimate interest" to continue holding it.
The data was processed unlawfully: The organization collected or used your information in breach of data protection laws.
There is a legal obligation: The data must be deleted to comply with a legal ruling or statutory obligation.
The data belongs to a child: The data was collected from a child to offer "information society services" (like a social media platform or online app) who may not have fully understood the implications of sharing it.
Exceptions to the right
Even if your request falls under the categories above, organizations can lawfully refuse your erasure request under specific, legally defined exemptions. Your data may not be deleted if its retention is strictly necessary for:
Freedom of expression and information: If the data is being used for journalistic, academic, or artistic purposes that serve the public interest.
Complying with a legal obligation: If another law dictates that the organization must retain the records (such as keeping payroll and tax data for HMRC).
Public interest or official authority: When the data is necessary for tasks carried out in the public interest, such as crucial public health tracking.
Archiving and research: If erasing the data would seriously impair or make impossible the achievement of scientific, historical, or statistical research objectives.
Defending legal claims: The organization needs the data to establish, exercise, or defend against ongoing or potential legal claims.
How to exercise your right
You can make a request for erasure verbally or in writing to any part of the organization holding your data. Once an official request is made, the organization generally has one calendar month to respond and comply, though particularly complex requests may legally be extended by up to two additional months.
When you submit your request to a company, be prepared to:
Be specific: Clearly outline what data you are targeting and state which of the Article 17 grounds you believe applies to your request.
Verify your identity: Organizations need to ensure they are deleting data for the right person so they do not accidentally erase someone else's files. They may ask for basic verification, but ensure you only provide the minimum amount of information necessary to prove who you are.
While the law is firmly on your side, individually contacting every data broker, marketing agency, and former service provider to exercise your Article 17 rights is a monumental administrative chore. Organizations often make the process intentionally confusing, require multiple follow-ups, or drag their feet until the final day of the one-month deadline.
If you value your privacy but don't have the time to wage a continuous battle against data collectors, Prifox can do the heavy lifting for you. Prifox automates the complexities of data removal by tracking down your exposed information across the web and officially exercising your right to erasure on your behalf. We ensure your opt-out requests are legally sound, monitor corporate compliance, and keep your personal data off the market permanently.
Take control of your digital privacy the smart way. Visit Prifox.com to effortlessly enforce your right to be forgotten.