The Right to Erasure (Right to Be Forgotten)

Article 17 of the UK GDPR gives individuals the right to request the erasure of personal data where:

• It’s no longer needed for its original purpose
• The data subject withdraws consent
• The data was unlawfully processed
• They object to processing (and there are no overriding grounds)

However, this isn’t absolute. You may retain data if you need it for legal claims, compliance, or public interest.

💡 Tip:

Map your data retention policies now — so when a request comes in, you’ll know what can (and can’t) be deleted immediately.