---
title: "Art. 17 GDPR: Right to erasure (‘right to be forgotten’)"
canonical: "https://dposchool.com/gdpr/article/17"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_17"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 17 GDPR · Chapter III: Rights of the data subject · Section 3: Rectification and erasure

# Article 17 GDPR: Right to erasure (‘right to be forgotten’)

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

The data subject has the right to have personal data erased without undue delay where one of the grounds in paragraph 1 applies, and a controller that has made the data public must take reasonable steps to inform other controllers of the request. Paragraph 3 lists the cases in which the right does not apply, such as freedom of expression, compliance with a legal obligation and legal claims.

## Official text

### Article 17(1)

**1.** The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

#### Article 17(1)(a)

**(a)** the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

#### Article 17(1)(b)

**(b)** the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

#### Article 17(1)(c)

**(c)** the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

#### Article 17(1)(d)

**(d)** the personal data have been unlawfully processed;

#### Article 17(1)(e)

**(e)** the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

#### Article 17(1)(f)

**(f)** the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

### Article 17(2)

**2.** Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

### Article 17(3)

**3.** Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

#### Article 17(3)(a)

**(a)** for exercising the right of freedom of expression and information;

#### Article 17(3)(b)

**(b)** for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

#### Article 17(3)(c)

**(c)** for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

#### Article 17(3)(d)

**(d)** for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

#### Article 17(3)(e)

**(e)** for the establishment, exercise or defence of legal claims.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 17 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_17)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 65](https://dposchool.com/gdpr/recital/65)
- [Recital 66](https://dposchool.com/gdpr/recital/66)

## Court of Justice judgments

### [C-200/23, Agentsia po vpisvaniyata v OL](https://dposchool.com/gdpr/case/c-200-23)

Judgment of 4 October 2024 · ECLI:EU:C:2024:827

A commercial register that publishes company documents is a controller and recipient of the personal data in them; it cannot refuse erasure of unrequired data; loss of control can be non-material damage.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-200/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0200)

### [C-26/22, UF and AB v Land Hessen](https://dposchool.com/gdpr/case/c-26-22)

Judgment of 7 December 2023 · ECLI:EU:C:2023:958

Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-26/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0026)

### [C-60/22, UZ v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-60-22)

Judgment of 4 May 2023 · ECLI:EU:C:2023:373

A failure to conclude a joint-controller arrangement or keep a record of processing does not by itself make processing unlawful or give a right to erasure or restriction.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-60/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060)

### [C-460/20, TU and RE v Google LLC](https://dposchool.com/gdpr/case/c-460-20)

Judgment of 8 December 2022 · ECLI:EU:C:2022:962

A person seeking delisting of allegedly inaccurate content need not first obtain a court ruling; they must show manifest inaccuracy with evidence reasonably required; for photo thumbnails, their own informative value is assessed.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-460/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0460)

### Related (earlier law or other instruments)

#### [C-129/21, Proximus NV v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-129-21)

Judgment of 27 October 2022 · ECLI:EU:C:2022:833

Instrument: GDPR together with the ePrivacy Directive

Consent to appear in phone directories, given once, covers all directory publishers; a request to be removed is an erasure request, and the controller must inform other controllers it supplied.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-129/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0129)

#### [C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-136-17)

Judgment of 24 September 2019 · ECLI:EU:C:2019:773

Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)

The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-136/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0136)

#### [C-507/17, Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-507-17)

Judgment of 24 September 2019 · ECLI:EU:C:2019:772

Instrument: GDPR together with Directive 95/46

A search engine that grants delisting need not do so on all versions worldwide, but must do so on all EU versions and use measures to discourage EU users from reaching the links.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-507/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0507)

#### [C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González](https://dposchool.com/gdpr/case/c-131-12)

Judgment of 13 May 2014 · ECLI:EU:C:2014:317

Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)

A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-131/12&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131)

## EDPB guidance

### [Guidelines 02/2025 on processing of personal data through blockchain technologies](https://dposchool.com/gdpr/guidance/edpb-02-2025)

EDPB 02/2025 · Final · First published 14 April 2025 · Final version 7 July 2026

Version 2 is final.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en)

### [Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)](https://dposchool.com/gdpr/guidance/edpb-05-2019)

EDPB 05/2019 · Final · First published 11 December 2019 · Final version 7 July 2020

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-52019-on-the-criteria-of-the-right-to-be-forgotten-in-the-search_en)

## Fines

Amounts are shown in the currency in which the fine was imposed.

### [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 15 June 2023 · Appeal status: unknown

Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063)

### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/cnil-clearview-2022-10)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 17 October 2022 · Appeal status: unknown

Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859)

### [Google LLC: EUR 10,000,000](https://dposchool.com/gdpr/fine/aepd-google-2022-05)

Agencia Española de Protección de Datos (AEPD), Spain · Announced on 18 May 2022 · Appeal status: unknown

Search and video platform forwarded people's content-removal requests (identity, email, reasons, URLs) to a public third-party database without a legal basis, which frustrated the right to erasure.

Not fully confirmed: AEPD press release of 18 May 2022 (procedure PS/00140/2020). The decision date and the split of the fine between the two infringements are not confirmed.

[Source: the authority](https://www.aepd.es/en/prensa-y-comunicacion/notas-de-prensa/the-aepd-has-imposed-sanction-on-google-llc-for-transferring-personal-data-to-third-parties)

### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown

Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.

Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756)

### [Google LLC: SEK 75,000,000](https://dposchool.com/gdpr/fine/imy-google-2020-03)

Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 10 March 2020 · Appeal status: reduced

Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.

[Source: the authority](https://www.imy.se/tillsyner/google/)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 17

Previous: [Art. 16 GDPR: Right to rectification](https://dposchool.com/gdpr/article/16)

Next: [Art. 18 GDPR: Right to restriction of processing](https://dposchool.com/gdpr/article/18)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents