Data subject rights 3 minutes read

Erasure: when it applies and when it does not

The "right to be forgotten" is not a general right to have things deleted. It applies in six cases – and is limited by five exceptions, the most common being a statutory duty to retain.

The right exists not because a person wishes deletion but because one of six grounds applies. In practice the first is the most important: the purpose for which the data was collected has been fulfilled or has lapsed.

The two-step assessment

Does the original purpose still exist, or is there another legal basis for this data?
Yes – purpose or basis remainsNo right to erasure. What remains to be checked is whether an objection under Article 21 applies or whether processing has to be restricted.
No – both have lapsedThe right to erasure exists. All that remains is whether one of the five exceptions applies – above all a statutory retention duty.
The order matters: starting with the exceptions usually turns one up – tax retention duties touch almost every company record somehow. Purpose first, exception second.

The six grounds

  • The purpose is fulfilled or has lapsed.
  • Consent was withdrawn and no other basis exists.
  • An objection was raised and no overriding grounds exist. For direct marketing that is always the case.
  • The processing was unlawful.
  • A legal obligation requires erasure.
  • The data was collected in connection with an offer aimed at children.

When a retention duty stands in the way

The most common conflict in practice: a customer demands erasure, but invoices are subject to a tax retention period. The resolution lies not in refusing the request but in splitting it.

Everything not covered by the duty has to go – the customer account, the newsletter entry, the usage profile, the contact notes. What must be retained stays but is restricted in its processing: blocked for any use other than fulfilling that particular duty.

Passing the erasure on

Where the data was published or passed to others, Article 17(2) requires reasonable steps to bring about erasure there too. The standard is proportionate: available technology and cost may be taken into account. A message to every known recipient belongs to it in any case – and that presupposes a record of who received data at all.

This closes the circle back to the record of processing activities: without a list of recipients this duty cannot be met, however good the intentions.

Published 14 September 2026

This article explains general principles and does not replace legal advice on an individual case.

Read next

Back to the overview