Art. 17 GDPR · Chapter III: Rights of the data subject · Section 3: Rectification and erasure
Article 17 GDPR: Right to erasure (‘right to be forgotten’)
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The data subject has the right to have personal data erased without undue delay where one of the grounds in paragraph 1 applies, and a controller that has made the data public must take reasonable steps to inform other controllers of the request. Paragraph 3 lists the cases in which the right does not apply, such as freedom of expression, compliance with a legal obligation and legal claims.
Official text
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise or defence of legal claims.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-200/23, Agentsia po vpisvaniyata v OL
Judgment of 4 October 2024ECLI:EU:C:2024:827
A commercial register that publishes company documents is a controller and recipient of the personal data in them; it cannot refuse erasure of unrequired data; loss of control can be non-material damage.
- C-26/22, UF and AB v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:958
Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.
- C-60/22, UZ v Bundesrepublik Deutschland
Judgment of 4 May 2023ECLI:EU:C:2023:373
A failure to conclude a joint-controller arrangement or keep a record of processing does not by itself make processing unlawful or give a right to erasure or restriction.
- C-460/20, TU and RE v Google LLC
Judgment of 8 December 2022ECLI:EU:C:2022:962
A person seeking delisting of allegedly inaccurate content need not first obtain a court ruling; they must show manifest inaccuracy with evidence reasonably required; for photo thumbnails, their own informative value is assessed.
Related (earlier law or other instruments)
- C-129/21, Proximus NV v Gegevensbeschermingsautoriteit
Judgment of 27 October 2022ECLI:EU:C:2022:833
Instrument: GDPR together with the ePrivacy Directive
Consent to appear in phone directories, given once, covers all directory publishers; a request to be removed is an erasure request, and the controller must inform other controllers it supplied.
- C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:773
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them.
- C-507/17, Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:772
Instrument: GDPR together with Directive 95/46
A search engine that grants delisting need not do so on all versions worldwide, but must do so on all EU versions and use measures to discourage EU users from reaching the links.
- C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González
Judgment of 13 May 2014ECLI:EU:C:2014:317
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights.
EDPB guidance
- Guidelines 02/2025 on processing of personal data through blockchain technologies
EDPB 02/2025FinalFirst published 14 April 2025Final version 7 July 2026
Version 2 is final.
- Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)
EDPB 05/2019FinalFirst published 11 December 2019Final version 7 July 2020
Fines
Amounts are shown in the currency in which the fine was imposed.
- CRITEO: EUR 40,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 15 June 2023Appeal status: unknown
Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.
- Clearview AI: EUR 20,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 17 October 2022Appeal status: unknown
Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.
- Google LLC: EUR 10,000,000
Agencia Española de Protección de Datos (AEPD), SpainAnnounced on 18 May 2022Appeal status: unknown
Search and video platform forwarded people's content-removal requests (identity, email, reasons, URLs) to a public third-party database without a legal basis, which frustrated the right to erasure.
Not fully confirmed: AEPD press release of 18 May 2022 (procedure PS/00140/2020). The decision date and the split of the fine between the two infringements are not confirmed.
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.
- Google LLC: SEK 75,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 10 March 2020Appeal status: reduced
Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.