Skip to main content
Praxikon
Agent check

Article 17: Right to erasure (‘right to be forgotten’)AI-relevant

Praxikon tracks Article 17 (Right to erasure (‘right to be forgotten’)) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

What does Article 17 govern?

Article 17 gives everyone the right to have their personal data erased and obliges the controller to do so without undue delay in six situations (paragraph 1): the data are no longer necessary for the purpose, consent has been withdrawn and no other legal ground exists, an objection has been made under Article 21, the processing was unlawful, a legal obligation requires erasure, or the data were collected from a child in relation to an online service referred to in Article 8(1). If you have made the data public, you take reasonable steps to inform other controllers that the data subject has requested erasure of links and copies (paragraph 2). Paragraph 3 lists the exceptions: freedom of expression, a legal obligation or task in the public interest, public health, archiving and research, and legal claims. The article exists because keeping data that are no longer necessary or were processed unlawfully infringes the Regulation, and because people, especially those who gave consent as a child, must be able to have data removed from the internet later (recitals 65 and 66).

Key term: Right to erasure: the right to have your data deleted when there is no longer a valid reason to keep them

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

/
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (e) for the establishment, exercise or defence of legal claims.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

You test every erasure request against the six grounds in paragraph 1 and erase the data without undue delay where one of them applies, including data you use in, for example, an AI application. Where you have made the data public, you take reasonable steps, taking account of available technology and cost, to inform other controllers of the request (paragraph 2). If you refuse, that rests on an exception in paragraph 3, such as a statutory retention obligation, and you explain the reasons in line with Article 12(4).

Data Subject

You can ask for erasure in the situations of paragraph 1, for example when you withdraw consent, when the data are no longer needed or when you have objected. This also applies to data you provided as a child, even now that you are an adult (recital 65). Where one of those situations applies, the controller may refuse only for the reasons in paragraph 3 and must then explain why.

Compliance checklist

Related recitals

(65)

A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member S...

(66)

To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged ...

Cross-references

Art. 6: Lawfulness of processingArt. 8: Conditions applicable to child's consent in relation to information society servicesArt. 9: Processing of special categories of personal dataArt. 21: Right to objectArt. 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

More case law, guidelines and fines

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (12)

  • 18 June 2026 · C-484/24 · CJEU
    NTH Haustechnik

    A court using evidence containing personal data processes it under a legal obligation, provided clear national case law sets the conditions. Unlawfully obtained evidence is not automatically excluded, but before disclosing it further the court must limit the data to what is necessary.

  • 4 September 2025 · C-655/23 · CJEU
    Quirin Privatbank

    Negative feelings such as fear or annoyance are non-material damage if the data subject proves them. The GDPR itself gives no right to an injunction against future breaches, but national law may, without reducing compensation.

  • 4 October 2024 · C-200/23 · CJEU
    Agentsia po vpisvaniyata

    A commercial register that publishes personal data is a controller, including for data that were not required. A handwritten signature is personal data, and a brief loss of control over data can be non-material damage.

  • 14 March 2024 · C-46/23 · CJEU
    Újpesti Polgármesteri Hivatal

    A supervisory authority may order erasure of unlawfully processed data on its own initiative, without a request from the data subject and even if the data were collected from the data subject.

  • 7 December 2023 · C-26/22, C-64/22 · CJEU
    SCHUFA (debt discharge)

    A credit agency may not keep data on a debt discharge longer than the public register does. A supervisory authority's decision on a complaint is subject to full judicial review.

Show 7 more
  • 4 May 2023 · C-60/22 · CJEU
    UZ v Bundesrepublik Deutschland

    The absence of a joint controller arrangement or of a record of processing does not in itself make processing unlawful, so it gives no right to erasure or restriction.

  • 8 December 2022 · C-460/20 · CJEU
    TU and RE v Google

    Anyone asking for de-referencing because of inaccurate information must show the manifest inaccuracy with evidence that can reasonably be required; a court ruling is not needed.

  • 27 October 2022 · C-129/21 · CJEU
    Proximus

    Inclusion in public telephone directories requires consent within the meaning of the GDPR. A request to be removed from directories is an exercise of the right to erasure, and the directory provider must take reasonable steps to inform other providers and search engines.

  • 24 September 2019 · C-136/17 · CJEUDirective 95/46
    GC and Others v CNIL

    The prohibition on processing special category and criminal data also applies to a search engine, within its role when assessing a de-referencing request. For outdated reports on criminal proceedings, the current situation must appear first in the results.

  • 24 September 2019 · C-507/17 · CJEU
    Google v CNIL

    A search engine need not de-reference results worldwide, but must do so on the versions for all Member States, with measures that discourage access from within the Union where needed.

  • 9 March 2017 · C-398/15 · CJEUDirective 95/46
    Manni

    There is in principle no right to have data erased from the companies register. Member States may only exceptionally, after a long period and case by case, limit access by third parties.

  • 13 May 2014 · C-131/12 · CJEUDirective 95/46
    Google Spain

    A search engine processes personal data as a controller and falls under EU law through a sales establishment in a Member State. Data subjects can ask for results on their name to be removed, the origin of the right to be forgotten.

Guidelines (2)

Fines (1)

  • 15 July 2021 · CNPD (Luxembourg)€746,000,000
    Amazon: targeted advertising without a valid legal basis

    Amazon processed personal data for interest-based advertising on the basis of legitimate interest, which was not a valid legal basis. It also fell short on informing users and on honouring rights such as access, rectification and erasure.

    The administrative tribunal upheld the fine on 18 March 2025. On appeal, the Administrative Court annulled the decision on 12 March 2026 and sent the case back to the CNPD, because the CNPD had not assessed whether Amazon acted intentionally or negligently and had not weighed which corrective measure was most appropriate. The core findings of infringement were confirmed; the Article 21 complaints were held to fall outside the scope of the inquiry.

Line of case lawThe right to be forgotten

When must information disappear from search results or registers?

  1. Google Spain (2014)Basis for removing search results on your name.
  2. Manni (2017)No general right to erasure from the companies register.
  3. GC and Others v CNIL (2019)Sensitive and criminal data carry extra weight.
  4. Google v CNIL (2019)De-reference in all EU versions, not necessarily worldwide.
  5. Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) (2020)The EDPB describes the grounds and exceptions for search engines.
  6. TU and RE v Google (2022)For manifestly inaccurate information no court ruling is needed.

Checked on 5 November 2026

Frequently asked questions

← Art. 16: Right to rectificationArt. 18: Right to restriction of processing →

Connections

What connects to Article 17 GDPR

Case law

Guidelines

Enforcement and fines