GDPR Article 17: right to erasure
Article 17 GDPR gives a right to have personal data erased without undue delay in defined cases; delisting from search engines is its best-known application.
Grounds
The controller must erase data without undue delay where:
- they are no longer necessary for the original purpose,
- consent is withdrawn and there is no other legal basis,
- the person objects under Article 21 and there are no overriding legitimate grounds,
- they were processed unlawfully,
- a legal obligation requires erasure,
- they were collected in relation to information society services offered to a child.
Data made public
A controller who made data public must take reasonable steps to inform other controllers processing it.
Exceptions
Freedom of expression and information, legal obligations or public tasks, public health, archiving and research, and legal claims.
Search engines
Since the Court of Justice's Google Spain ruling in 2014, search engines must delist outdated or irrelevant results for a person's name. See our right to be forgotten guide.
General information, not legal advice. In real cases we work alongside lawyers who specialise in digital rights.
Frequently asked questions
Does the GDPR apply in the UK?
The UK applies the UK GDPR, which contains an equivalent right; complaints go to the ICO.