What is the right to be forgotten?
The right to be forgotten is a person's right to have an organization delete the personal data it holds about them. In the EU General Data Protection Regulation (GDPR), Article 17 is titled the right to erasure, with "right to be forgotten" in parentheses. It applies only in defined situations and has firm exceptions, so a valid request often ends in partial deletion: some data goes at once, and some is kept until a legal duty to retain it expires.
When the right applies
A data subject can require erasure when, for example:
- the data is no longer needed for the purpose it was collected for;
- they withdraw the consent the processing relied on, and no other legal basis applies;
- they object to the processing and the organization has no overriding legitimate grounds, or they object to direct marketing;
- the data was processed unlawfully, or a legal obligation requires its erasure;
- the data was collected from a child for an online service.
When an organization can keep the data
The right is not absolute. GDPR lets the controller refuse erasure where keeping the data is necessary for freedom of expression and information; to comply with a legal obligation, such as tax or anti-money laundering record keeping; for public health; for archiving, research or statistics in the public interest; or to establish, exercise or defend legal claims. A legal hold falls under the last exception: data preserved for litigation stays until counsel releases the hold. The organization tells the requester what it kept and why, then deletes that data when the exception ends.
Carrying out an erasure request
- Verify the requester's identity, because a forged deletion request can be used to wipe out someone's account or records.
- Use the data inventory to find every copy: production databases and replicas, data warehouses, logs, search indexes, file shares, email and SaaS tools.
- Check each item against retention rules and legal holds, then delete or irreversibly anonymize what may go.
- Pass the request on to processors and other recipients that received the data, unless that proves impossible or takes disproportionate effort.
- Put data in backups beyond use until those backups expire, and keep a list of erased IDs that is reapplied after any restore.
- Respond within GDPR's one-month deadline, or up to three months for complex cases, and log the request and the actions taken.
Where the name comes from
The phrase spread after a 2014 ruling by the Court of Justice of the European Union in the Google Spain case, which held that a search engine can be required to remove links to outdated or irrelevant information from searches on a person's name. GDPR, which has applied since May 2018, then wrote a broader erasure right into law. Similar rights exist elsewhere, such as the right to delete in California's Consumer Privacy Act, which gives a business 45 days to respond.
Right to be forgotten vs. related ideas
- Restriction of processing: the data is kept but not used; erasure removes it.
- Opt-out: stops one use, such as selling data or sending marketing, but leaves the data in place.
- Data retention: the schedule that sets minimum and maximum keeping periods; erasure requests work within it.
- Legal hold: a preservation order that overrides deletion, including erasure requests, while it lasts.
Right to be forgotten on the CompTIA Security+ exam
SY0-801 names the right to be forgotten among the privacy concepts in objective 5.4, which covers the elements of a security compliance program. A scenario where a former customer asks a company to delete all of their personal data points to it. Watch for the twist: if the data is under a legal hold or a legal retention requirement, the right answer is to keep and restrict that data, explain why to the person, and erase it when the duty ends. Distractors include processing restriction, which keeps the data; opt-out, which stops one use; and data correction, which fixes inaccurate data rather than removing it.