# GDPR Article 17: Right to Erasure (‘Right to Be Forgotten’)

- Source: https://support.icompaas.com/support/solutions/articles/62000236361-gdpr-article-17-right-to-erasure-right-to-be-forgotten-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter III: Rights of the Data Subject](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-3-rights-of-the-data-subject)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article grants data subjects the right to request the deletion of their personal data when it is no longer necessary for the purposes it was collected, consent is withdrawn, or the data has been unlawfully processed. Organizations must act without undue delay, taking into account applicable exemptions such as legal obligations or public interest purposes. Publicly disclosed data must also be erased from other controllers where feasible.  
  

### **Key Principles**

-   Data Minimization and Purpose Limitation: Personal data should only be retained as long as necessary.
    
-   Lawfulness: Erasure requests must be honored unless processing is legally required or justified by public interest.
    
-   Timely Action: Controllers must respond to erasure requests without undue delay.
    
-   Scope: Includes data shared with third parties or other controllers, where applicable.  
      
    

### **Organizational Applicability**

This article applies to all organizations processing personal data within the EU:

-   Controllers managing personal data of EU/EEA data subjects.
    
-   Public and private sector entities processing data for services, marketing, or operational purposes.
    
-   Teams responsible for records management, IT systems, marketing, and compliance.  
      
    

### **Implementation Requirements**

-   Implement procedures to receive, validate, and process erasure requests.
    
-   Ensure deletion of data from all systems, including backups and third-party processors where feasible.
    
-   Document decisions, actions taken, and any applicable exemptions.
    
-   Establish mechanisms to handle publicly disclosed data erasure.  
      
    

### **Implementation Guidance**

-   Use automated or manual tools to locate and delete personal data across systems.
    
-   Train staff to evaluate requests and determine exemptions accurately.
    
-   Coordinate with third-party processors to ensure erasure obligations are fulfilled.
    
-   Regularly review erasure policies and workflows for compliance and effectiveness.  
      
    

### **Periodic Review**

-   Frequency: Annually or when new data types or processing activities are introduced.
    
-   Responsible Role: Data Protection Officer (DPO) or Compliance Team.
    
-   Outcome: Confirm that data erasure processes are effective, timely, and compliant with GDPR.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover.
    
-   Legal Exposure: Enforcement actions or complaints for failure to erase data.
    
-   Reputational Damage: Loss of trust from data subjects, regulators, and stakeholders.
    
-   Operational Risk: Continued retention of unnecessary or unlawful data can affect compliance and decision-making.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.