DataTerminology.comNEW
Also known as: Right to Erasure
A data subject’s right to obtain deletion of personal data without undue delay under specific conditions.
DESCRIPTION
The right to be forgotten, formally the right to erasure, allows individuals to request deletion of personal data when certain grounds apply, such as withdrawal of consent or unlawful processing. Controllers must act without undue delay, subject to exceptions like legal obligations or freedom of expression. Implementing this right requires accurate identification, data mapping, and deletion across primary, backup, and third-party systems. Evidence of response and timing must be recorded for accountability.
ALTERNATIVE DEFINITIONS
EU GDPR (Regulation (EU) 2016/679)
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay.
Defines the essence and urgency of erasure right.
UK Information Commissioner’s Office (ICO)
You have the right to ask for your personal data to be erased.
Plain-language formulation for individuals about erasure rights.
RELATED TERMS
Data Purging Data Minimization Legal Basis Data Subject Access Request Data Controller Data Processor Privacy by Design Data Portability Consent Withdrawal
COMPETING TERMS
Data Retention
KNOWLEDGE AREAS
Data Privacy & Compliance Data Governance Data Management
TARGET AUDIENCE
Data Governance Manager Data Steward Chief Data Officer Chief Information Officer Data Engineer AI Product Manager
EXTERNAL SOURCES
- Wikipedia - Right to be forgotten
- ICO - Public guidance on erasure rights
- European Data Protection Board - Guidelines on erasure in search contexts
TOP QUESTIONS
When does the Right to be Forgotten apply?
Common grounds include withdrawal of consent, successful objection, unlawful processing, or when data is no longer necessary. Exceptions may still prevent deletion.
Category: Requirements
How fast must a controller respond to a Right to be Forgotten request?
Controllers must act without undue delay, generally within one month, extendable when justified under applicable law.
Category: Compliance
Do backups need to be deleted immediately for a Right to be Forgotten?
Backups may be exempt from immediate deletion but must not be restored except for emergencies, after which erasure should be applied.
Category: Risks
What if legal obligations conflict with the Right to be Forgotten?
Legal obligations may override erasure. Controllers should document the basis for refusal and inform the data subject.
Category: Conflict
How do we verify identity for a Right to be Forgotten request?
Use proportionate identity verification, balancing security with friction. Record verification steps.
Category: Process
How does the Right to be Forgotten affect ML models?
Models trained on personal data may need retraining or machine unlearning strategies to remove influence where required.
Category: AI
What evidence do auditors expect for erasure requests?
Logs of request receipt, verification, decision, deletion actions, and communications, with timestamps and scope.
Category: Audit
Does the Right to be Forgotten apply to anonymized data?
Truly anonymized data falls outside personal data scope. Pseudonymized data remains in scope.
Category: Misunderstanding
What systems complicate the Right to be Forgotten?
Distributed logs, caches, third-party processors, and analytics stores complicate full deletion without robust data mapping.
Category: Challenges