What is Right to Erasure (Right to Be Forgotten)?

The right to erasure, commonly referred to as the right to be forgotten, is a fundamental data subject right under Article 17 of the GDPR. It allows individuals to request the deletion of their personal data from an organization's systems. The controller must comply without undue delay when the data is no longer necessary for its original purpose, the individual withdraws consent, the individual objects to processing with no overriding legitimate grounds, the data was unlawfully processed, or deletion is required by law.

The right is not absolute and has several exceptions. Organizations may refuse erasure when processing is necessary for exercising freedom of expression, compliance with a legal obligation, public health purposes, archiving in the public interest, or establishing or defending legal claims. Similar rights exist under the CCPA (right to delete), DPDPA (right to erasure), and LGPD (right to deletion). Each regulation has its own scope, exceptions, and response timelines.

Fulfilling erasure requests requires organizations to locate all instances of the individual's data across every system, including backups and third-party processors. IQWorks addresses this through SearchIQ for comprehensive data subject searches, DiscoverIQ for maintaining a current data map, and automated deletion workflows that execute across connected systems while maintaining audit logs.