Right to erasure
Definition
The right of individuals to obtain deletion of their personal data without undue delay when a legal ground applies, such as data no longer needed or consent withdrawn.
Often called the "right to be forgotten", the right to erasure (GDPR Art. 17) applies when data is no longer necessary, consent is withdrawn and no other basis exists, the person successfully objects, the processing was unlawful, a legal obligation requires deletion, or the data was collected from a child for online services. It is not absolute: exceptions include freedom of expression, legal obligations, public health, archiving and research, and the establishment or defence of legal claims. If the data was made public, the controller must take reasonable steps to inform other controllers.
The LGPD (Art. 18, IV and VI) gives the right to deletion of unnecessary, excessive or unlawfully processed data and of data processed with consent, subject to the conservation exceptions of Art. 16.
Erasure is hard in AI systems. Deleting a record from a database is simple; removing its influence from a trained model may require retraining, filtering outputs or machine unlearning techniques. Backups, logs and vendor copies must also be covered.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 2: Data subject rights and requests.
Primary sources
- GDPR Art. 17
- LGPD Art. 18, IV and VI