The Right to Be Forgotten

The right to be forgotten is the everyday name for the right to erasure: your right under the UK GDPR to ask an organisation to delete personal data it holds about you. The law itself uses both names — Article 17 is headed “Right to erasure (‘right to be forgotten’)”.

It is a real and usable right, and asking costs nothing. But it is not absolute: it applies where one of a set of grounds is met, and it gives way where the organisation still has a lawful reason to keep the data. The two lists — when you can ask, and when they can refuse — are most of what this page covers, because knowing both is the difference between a request that lands and a refusal that surprises you.

For where erasure sits among your other data protection rights, see your data protection rights under UK GDPR.

Article 17 of the UK GDPR obliges an organisation to erase your personal data without undue delay where one of these grounds applies:

• the data is no longer necessary for the purpose it was collected for;
• the processing relied on your consent, you have withdrawn it, and there is no other legal ground for keeping the data;
• you have objected to the processing and the organisation has no overriding legitimate grounds — and where the objection is to direct marketing, there is nothing to weigh: it must stop;
• the data has been unlawfully processed;
• the data has to be erased to comply with a legal obligation under UK law;
• the data was collected from you as a child by an online service;
• since 2026, where the data comes from an allegation about you made maliciously, which the organisation investigated and decided needed no further action — a ground added to the UK GDPR to stop unfounded allegations following people through records.

You do not need to name the ground in your request, but matching your situation to one before you write makes the request much harder to bat away — and if none of them fits, erasure may simply not be the right tool, which is worth knowing before you spend a month waiting.

Article 17 also lists the situations where the right does not apply — where processing remains necessary:

• for freedom of expression and information — the ground that covers journalism and much published material;
• to comply with a legal obligation, or to perform a task in the public interest or under official authority — why a bank must keep records money-laundering law requires, and why HMRC will not delete your tax history;
• for public health reasons;
• for archiving, research or statistical purposes, where erasure would seriously impair them;
• for the establishment, exercise or defence of legal claims.

A refusal on one of these grounds can be entirely proper. What an organisation cannot do is ignore you, refuse without saying why, or rely on a ground that does not actually cover the data you named — which is one reason to be specific about what you want deleted.

Erasure is irreversible in the one direction that matters to you: once data is deleted, you can never see what it said. If any part of why you want deletion is wanting to know what they held — what was recorded about you, where it came from, who it was shared with — get a copy first with a subject access request, then ask for erasure.

A subject access request also does practical work for an erasure request: the response shows you exactly what exists and often reveals the ground — data kept long after its purpose ended, processing you never consented to, or an old allegation still sitting on a file. You name what you found; the erasure request writes itself.

The subject access request is free to make yourself — our free letter generator will word it for you — or GetMySAR can prepare, send and chase it for you.

Send it to the organisation that holds the data. There is no official form and nothing to pay:

• say who you are, with the details they know you by;
• say you are asking for erasure of your personal data — naming Article 17 or “the right to be forgotten” helps routing but is not required;
• say which data — everything they hold, or specific records — and, if you can, why the right applies to it;
• keep a copy, and note the date you sent it.

One more thing the law does for you: where an organisation has made the data public and must now erase it, Article 17 requires it to take reasonable steps to tell other organisations processing that data about your request — you do not have to chase every copy yourself, though it is a duty of reasonable steps, not a guarantee.

An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

A proper refusal names its ground. If the answer is no, check the ground given against section 3 — and remember that a ground has to cover the specific data you asked about, not just some of what the organisation holds. A refusal to erase everything is not a refusal to erase anything.

Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

Where erasure genuinely is not available, the other rights can still move things: rectification if the data is wrong, restriction while a dispute is resolved, and objection — which for direct marketing always succeeds.

Erasure is one of eight individual rights, and it is not always the strongest move. Deleting data ends your visibility of it; objection stops what is being done with it; restriction freezes it while a question is settled; rectification fixes it. Each is explained, with how to use it, in your data protection rights under UK GDPR — and any of them can be raised in the same letter as an erasure request. For the request-making mechanics shared by all of them, see how to make a GDPR request.

GetMySAR’s service is the subject access request — the see-your-data-first step in section 4. For a service fee of £20 we prepare the request, send it to a verified route, track the deadline and follow up until you have your data.

The erasure request itself is yours to send, it is free, and this page is the guide. We do not charge for erasure requests, and you should be wary of anyone who charges to “remove” data an organisation is legally entitled to keep — a fee does not change the grounds in section 3.