The General Data Protection Regulation (GDPR) Article 17 establishes the most comprehensive framework for the right to erasure globally. Implemented on May 25, 2018, it applies to any organization processing personal data of EU residents, regardless of where the organization is located. This extraterritorial scope has made GDPR the de facto global standard for data protection, influencing privacy legislation worldwide.
GDPR Article 17(1) specifies six distinct grounds under which a data subject has the right to obtain erasure of their personal data without undue delay:
One of GDPR's most significant requirements is found in Article 17(2): when a controller has made personal data public and is obliged to erase it, the controller must take reasonable steps, including technical measures, to inform other controllers processing the data that the data subject has requested erasure of any links to, copies of, or replications of that personal data.
This provision recognizes the distributed nature of modern data systems and attempts to ensure that deletion requests have effect beyond a single organization's databases. However, the requirement is limited to "reasonable steps" rather than guaranteeing complete erasure across all systems, acknowledging practical limitations. What constitutes "reasonable steps" depends on factors including the available technology, cost of implementation, and the nature of the data.
The right to erasure is not absolute. Article 17(3) specifies situations where the right does not apply:
| Exception | Description | Examples |
|---|---|---|
| Freedom of Expression | Processing necessary for exercising the right of freedom of expression and information | Journalism, academic research, artistic expression, political commentary |
| Legal Compliance | Processing necessary for compliance with a legal obligation or performing a task in the public interest | Tax records, regulatory filings, court-ordered data retention |
| Public Health | Processing necessary for reasons of public interest in public health | Disease surveillance, vaccine safety monitoring, pandemic response |
| Archiving & Research | Processing necessary for archiving in the public interest, scientific/historical research, or statistical purposes | National archives, longitudinal medical studies, demographic research |
| Legal Claims | Processing necessary for the establishment, exercise, or defense of legal claims | Litigation records, dispute resolution, evidence preservation |
The California Consumer Privacy Act (CCPA), effective January 1, 2020, and enhanced by the California Privacy Rights Act (CPRA) effective January 1, 2023, establishes deletion rights for California residents. While similar in principle to GDPR, CCPA/CPRA takes a somewhat different approach in its implementation.
Under CCPA Section 1798.105, consumers have the right to request that a business delete any personal information about the consumer that the business has collected. The business must delete the consumer's personal information from its records and direct any service providers to delete the consumer's personal information from their records, unless an exception applies.
CCPA provides eleven specific exceptions where businesses may deny deletion requests:
Brazil's Lei Geral de Proteção de Dados (LGPD), effective September 2020, establishes comprehensive data protection rights including the right to erasure. LGPD draws heavily from GDPR while incorporating elements specific to Brazilian law and culture.
LGPD Article 18 grants data subjects the right to request deletion of personal data processed with consent or when unnecessary, excessive, or processed in violation of the law. The controller must respond to requests within 15 days, a shorter timeframe than GDPR or CCPA.
Following Brexit, the United Kingdom implemented UK GDPR, which largely mirrors EU GDPR but applies specifically within UK jurisdiction. The Data Protection Act 2018 provides the UK-specific implementation framework. The Information Commissioner's Office (ICO) enforces these provisions and provides detailed guidance on the right to erasure.
Japan's amended APPI, effective April 2022, includes provisions similar to the right to erasure, though not identical. Japanese law emphasizes notification and correction of inaccurate data and allows data subjects to request suspension of use or deletion when data is handled improperly. The Personal Information Protection Commission (PPC) oversees enforcement.
China's PIPL, effective November 2021, grants individuals the right to request deletion of personal information in specific circumstances, including when the retention period has expired, when processing purposes have been achieved, when consent is withdrawn, or when processing violates laws or agreements. PIPL includes unique provisions reflecting China's regulatory environment, such as security review requirements for cross-border data transfers.
South Africa's POPIA, fully effective July 2021, provides data subjects the right to request destruction or deletion of personal information. The Information Regulator oversees compliance and can issue enforcement notices requiring data controllers to comply with deletion requests.
In the United States, the Health Insurance Portability and Accountability Act (HIPAA) does not grant patients a general right to deletion of their medical records. However, HIPAA does allow individuals to request amendments to their records and provides specific rights regarding the accounting of disclosures. Some states have enacted laws providing healthcare-specific deletion rights that go beyond HIPAA.
In the EU, GDPR applies to health data as "special category" data requiring enhanced protections, but standard GDPR exceptions often apply to medical records due to legal retention requirements and public health interests.
Financial institutions face extensive record-keeping requirements under anti-money laundering (AML) laws, know-your-customer (KYC) regulations, and financial reporting obligations. These requirements typically mandate retention of customer records, transaction data, and compliance documentation for periods ranging from 5 to 10 years or longer.
When processing deletion requests, financial institutions must carefully navigate the tension between privacy rights and regulatory obligations. Generally, data required for ongoing compliance with financial regulations falls under the legal obligation exception to deletion rights.
In the United States, the Family Educational Rights and Privacy Act (FERPA) governs student education records. While FERPA provides parents and eligible students rights to access and amend records, it does not provide a general right to deletion. Educational institutions must retain certain records for institutional and legal purposes.
GDPR and similar laws do apply to educational data in jurisdictions where those laws are in effect, but educational institutions can invoke exceptions for archiving in the public interest and compliance with legal obligations.
Before processing a deletion request, organizations must verify the identity of the requester to prevent fraudulent requests that could result in improper deletion of data belonging to others. Verification methods should be proportionate to the sensitivity of the data and the risks involved. Common approaches include:
| Jurisdiction | Timeline | Extension Allowed | Notes |
|---|---|---|---|
| GDPR (EU/UK) | 1 month | 2 additional months if complex | Must inform data subject of extension within 1 month |
| CCPA/CPRA (California) | 45 days | 45 additional days | Must notify consumer of extension and reasons |
| LGPD (Brazil) | 15 days | Case-by-case basis | Shorter timeline than most jurisdictions |
| PIPL (China) | Reasonable period | Not specified | Enforcement guidance still developing |
Organizations must maintain comprehensive records of deletion requests and their processing to demonstrate compliance. Documentation should include:
When an organization determines it must deny a deletion request due to a legal exception, it must:
When personal data has been transferred internationally, deletion requests create additional complexity. Organizations must consider:
Failure to properly handle deletion requests can result in significant penalties under various privacy laws:
GDPR violations can result in administrative fines up to €20 million or 4% of annual global turnover, whichever is higher. Factors considered in determining fines include the nature and severity of the infringement, intentionality, number of affected data subjects, cooperation with authorities, and previous violations.
CCPA violations can result in civil penalties up to $2,500 per violation or $7,500 per intentional violation. CPRA enhanced enforcement with the establishment of the California Privacy Protection Agency, which can seek administrative fines and corrective action.
Beyond regulatory penalties, individuals may have private rights of action for certain violations, particularly those involving data breaches resulting from failure to implement reasonable security measures. Class action lawsuits can result in significant damages and settlements.