- Article 17 of the GDPR lets a person ask for their personal data to be erased.
- It applies on six listed grounds, and gives way to five listed exceptions.
- Article 12(3) sets the time to answer: within one month, extendable.
Sooner or later, someone writes to your support inbox and asks you to delete everything you hold about them. The request is short. The answer runs through your whole product: the account, the records it touches, the files it uploaded, the people who need to know. Whether that answer is easy or painful is decided long before the email arrives.
The rule behind the request is Article 17 of Regulation (EU) 2016/679, the General Data Protection Regulation. Its heading is “Right to erasure (‘right to be forgotten’)”. This guide sets out what the article says, in plain terms, with the source linked next to each legal fact.
It is not legal advice, and it does not tell you whether your product meets the law. That judgement is yours and your advisers’ to make. If you want the wider question of building privacy into a product from the start, Data protection by design, for product leaders covers Article 25. This guide stays with one right and one request.
What the right is
A person can ask the controller to erase personal data about them, and on the listed grounds the controller must do so. Article 17(1) gives the data subject “the right to obtain from the controller the erasure of personal data concerning him or her without undue delay”, and puts the controller under “the obligation to erase personal data without undue delay” where one of the grounds applies.
The controller is the person or body that, alone or with others, decides why and how the data is processed (Article 4(7)). If people sign up to your product and you decide what it does with their details, that is usually you. If your customers run your product for their own users, the question of who the controller is deserves an answer from your advisers before the first request arrives.
When a person may ask
The right applies where one of six grounds in Article 17(1) is met. In the article’s own order:
- The data are “no longer necessary in relation to the purposes for which they were collected or otherwise processed”.
- The person withdraws the consent the processing rests on, “and where there is no other legal ground for the processing”.
- The person objects to the processing under Article 21, on the terms that article sets.
- The data “have been unlawfully processed”.
- The data have to be erased to comply with a legal obligation in Union or Member State law that the controller is subject to.
- The data were collected in relation to the offer of information society services referred to in Article 8(1), the article on a child’s consent.
The first ground is the one a product meets most quietly. An account closed years ago, a trial that never converted, an export someone downloaded once: each is data that may have outlived its purpose, whether or not anyone writes in.
When the right does not apply
Article 17(3) lists five cases where the right gives way, each “to the extent that processing is necessary”:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation, or for a task carried out in the public interest or in the exercise of official authority;
- for reasons of public interest in the area of public health;
- for archiving in the public interest, scientific or historical research, or statistics, where erasure would make those aims impossible or seriously impair them;
- “for the establishment, exercise or defence of legal claims”.
Note the words “to the extent”. An exception covers the part of the data that the purpose needs, not the whole account by default. Which exception applies, and how far, is a legal judgement, not a product one. What the product can do is make it possible to keep one part and remove the rest.
How soon the person hears back
The answer is due without undue delay, and within one month of receipt at the latest. Article 12(3) says the controller shall provide information on action taken on the request “without undue delay and in any event within one month of receipt of the request”. That period “may be extended by two further months where necessary, taking into account the complexity and number of the requests”, and the person must be told of any extension within one month, “together with the reasons for the delay”.
If the controller decides not to act, Article 12(4) says the person must still be told, within one month of receipt, the reasons and the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
There is one more duty that reaches beyond your own walls. Under Article 19, the controller communicates an erasure to each recipient the data has been disclosed to, “unless this proves impossible or involves disproportionate effort”, and tells the person about those recipients if they ask.
Three product questions
None of this needs a lawyer to sit in your design review. It needs three questions answered once, before the next request arrives.
Where does the data sit? Make a plain list of every place a person’s details end up: the account, the records tied to it, uploaded files, logs, exports, and the outside services you pass data to. A request is only as easy as that list is complete.
Who answers the request? Name the person or role who receives it, decides whether a ground or an exception applies, and carries it out. A request that lands in a shared inbox with no owner is the one that misses the month.
What is the person told? Write the replies before you need them: that the data has been erased, that part of it is kept and why, that more time is needed and why, or that no action is taken and where they can complain. Article 12(3) also says that a request made by electronic means is answered by electronic means where possible, unless the person asks otherwise.
Answer those three once, and the next request becomes a routine task rather than a scramble. You can lift your eyes from the inbox back to the product.
Where we come in
We do not advise on the GDPR, and we promise nothing about whether your product meets Article 17. That call stays with you and your advisers.
What we can do is build the changes to your product that you decide on. The work lands in your own code repository. The code we build for you is yours. You decide what ships. Nothing reaches your users without your approval.
It starts with a conversation, with no obligation.
