GDPR Article 17 is the EU right to erasure: people can require an organisation to delete their personal data when a ground listed in the law applies and no exception overrides it.
Article 17 of Regulation (EU) 2016/679 lists the grounds for erasure, including that the data are no longer necessary for their original purpose, consent has been withdrawn, the person has objected and there are no overriding legitimate grounds, the data have been processed unlawfully, erasure is required by law, or the data were collected from a child for an online service. A controller that has made the data public must also take reasonable steps to inform other controllers processing it of the erasure request.
The right is not absolute. Article 17(3) exempts processing needed for freedom of expression and information, compliance with a legal obligation or a task in the public interest, public health, archiving, research or statistics, and legal claims. Organisations must respond without undue delay and within one month, extendable by two further months for complex requests (Article 12(3)). The UK applies the same right under the UK GDPR.
In practice
Article 17 reaches websites, data brokers, platforms and search engines covered by the GDPR — those established in the EU or targeting people there — which makes it one of the broadest removal routes available. It works best for outdated, inaccurate or unnecessary personal information; journalism and matters of genuine public interest are usually protected by the freedom-of-expression exception. If an organisation refuses or does not reply, you can complain to a data protection authority.
Source: Regulation (EU) 2016/679 (GDPR), Art. 17 ↗
Related removals
- Right to be forgotten — $1,500 per URL, pay on success
- Personal info on Google — $1,500 per URL, pay on success
- SERP de-indexing — $1,500 per URL, pay on success
Related terms
- Right to be forgotten — The right to be forgotten lets people in the EU and UK ask search engines to delist results about them that are outdated, irrelevant or excessive, unless the public interest outweighs it.
- SERP de-indexing — SERP de-indexing is the removal of a specific URL from search engine results pages, so it stops appearing in searches even though the page itself may still exist.
- Data broker — A data broker is a company that collects personal information about people it has no direct relationship with and sells, licenses or publishes it, often through people-search websites.
- CCPA / CPRA — The CCPA is California's consumer privacy law, giving California residents rights over their personal information, including the right to ask covered businesses to delete it.
- Outdated content removal — Outdated content removal is asking a search engine to update or drop a result whose page has already been deleted or changed, so the old title and snippet stop appearing.