Right to Be Forgotten (Right to Erasure) in the UK

The "right to be forgotten" is the right to erasure under Article 17 UK GDPR. It is not absolute: it only applies on specific grounds, comes with several exemptions, and does not guarantee your data disappears from every corner of the internet.

What Is the Right to Be Forgotten?

"Right to be forgotten" is the everyday name for the right to erasure, the formal right set out in Article 17 of the UK GDPR. It lets you ask an organisation that holds your personal data to delete it. The name suggests something sweeping, but the legal right is narrower and more conditional than it sounds: it only applies where one of a specific list of grounds is met, and an organisation can lawfully refuse if one of a separate list of exemptions applies.

The right sits alongside, but is distinct from, your right to get a copy of your data (the subject access request) and your right to object to certain processing. See the subject access request guide and the UK GDPR overview for how erasure fits into the wider set of rights.

When You Can Ask for Erasure: The Grounds

An erasure request only has to be granted where at least one of these grounds under Article 17(1) applies:

• The personal data is no longer necessary for the purpose it was originally collected or processed for.
• You withdraw the consent the processing relied on, and there is no other lawful basis for the organisation to keep processing it.
• You object to the processing (using your right to object) and there is no overriding legitimate ground for the organisation to continue, or your objection relates to direct marketing, in which case erasure follows automatically.
• The data has been processed unlawfully.
• Erasure is required to comply with a legal obligation the organisation is subject to.
• The data was collected in connection with an online ("information society") service offered directly to a child.

If none of these grounds apply, an organisation is not obliged to erase your data simply because you would prefer it gone. This is the main reason the "right to be forgotten" is weaker in practice than its name implies.

When an Organisation Can Refuse: The Exemptions

Even where a ground above applies, Article 17(3) lets an organisation refuse erasure, or erase only part of the data, where the processing is necessary for one of these reasons:

• Exercising the right of freedom of expression and information, including journalistic, academic, artistic or literary purposes.
• Compliance with a legal obligation, or for the performance of a task carried out in the public interest or in the exercise of official authority.
• Reasons of public interest in the area of public health.
• Archiving purposes in the public interest, or scientific, historical research or statistical purposes, where erasure would be likely to seriously impair or prevent achieving those objectives.
• The establishment, exercise or defence of legal claims.

These exemptions explain why, for example, a news organisation can usually keep a factually accurate article online despite an erasure request, why a business may need to retain records to meet its own legal or tax obligations, and why data relevant to an ongoing legal dispute does not have to be deleted on request.

How to Make an Erasure Request

There is no prescribed form. You can make a request verbally or in writing, including by email or through a webform if the organisation provides one, and you do not have to use the words "right to erasure" or cite Article 17 for it to count as a valid request, though doing so helps make your intent clear. It is sensible to identify yourself clearly, describe the data you want deleted, and explain why you believe a ground for erasure applies.

The organisation must respond within one month of receiving a valid request, the same core timeframe that applies to a subject access request, and this can be extended by up to two further months for complex or numerous requests, with the organisation telling you within the first month if it needs the extension. There is normally no fee for making the request itself.

If the organisation agrees, it must also take reasonable steps to tell other controllers it knows are processing the same data, where it made that data public, so they are aware an erasure request has been made. It does not, however, guarantee that every downstream copy is found and removed.

Search Engines and Delisting

Asking a search engine such as Google to remove a search result is a different process from asking the website that published the data to delete it. This distinction traces back to the principle established in the CJEU's Google Spain ruling, that a search engine can itself be responsible for delisting a result under data protection law, separately from whether the underlying page stays online.

In practice this means two separate requests may be needed: one to the website hosting the content, and, if that does not resolve the issue, a separate request submitted directly to the search engine asking it to delist the specific search result from searches for your name. Delisting removes the page from that search engine's results; it does not delete the original page, and the content can still be found through other search engines, direct links, or by searching different terms.

What If Your Request Is Refused?

If an organisation refuses to erase your data, or does not respond within the required timeframe, it should explain its reasons, including which exemption it is relying on if that is the basis for refusal. If you disagree with the outcome, the next step is to complain to the organisation directly using its own complaints process, and if that does not resolve things, to complain to the ICO. See the ICO complaint guide for how that process works. You also have the option of applying to a court, though most people raise the ICO complaint route first.

A UK erasure request does not guarantee your data will disappear everywhere. It obliges the specific organisation you contacted, and any other controllers it is required to notify, but it cannot reach copies held by third parties who were never told, cached or archived versions, screenshots, backups, or services based outside the UK's regulatory reach. Treat erasure as a right to have a specific controller stop holding your data on valid grounds, not as a way to make information vanish from the internet entirely.

This article is for general information only and is not legal advice. Whether a particular request meets a ground for erasure, or whether an organisation can lawfully rely on an exemption, depends on the specific facts, so anyone unsure should seek independent advice or contact the ICO directly. For the wider picture of UK data protection rights, see the UK Data Privacy hub and the United Kingdom hub.