right to erasure
It is your right to request that a company or organization delete your personal data if it no longer has a legitimate reason to keep it.
In plain terms
Imagine you enrolled in a library years ago and never visited again. The right to deletion means you can go back and ask them to take your card out of the drawer and destroy it. The same applies online to web shops, social media platforms, apps, and AI services.
This right is guaranteed by Article 17 of the General Data Protection Regulation (GDPR), the European Union's data protection law. You can exercise it if the data is no longer needed, if you have withdrawn your consent, if you have objected to the processing, if the data was processed unlawfully, if the law requires deletion, or if the data was collected about you during childhood while using an online service.
It is not an unlimited right. The store keeps your invoices until the end of the accounting and tax retention period, the hospital preserves medical documentation, and the press keeps its public-interest articles due to freedom of expression and information.
In the age of artificial intelligence, there is a new difficulty: it is easy to delete a row from a database, but much harder to "extract" from a trained language model what it learned from texts about you.
How it works
- You submit a request to the data controller (company, authority, or provider). A single email or form is sufficient, no lawyer is needed, and it is generally free of charge.
- The data controller checks whether there is a legal basis or statutory obligation requiring the data to be retained. If they doubt whether you are indeed the one requesting deletion, they may request additional data to verify your identity.
- It must respond without undue delay, but within at most one month: either delete the data or explain why it cannot. In complex cases or due to many requests, this deadline may be extended by two further months, but you must be notified of this.
- If the controller has also passed the data on to others or made it public, it must take reasonable steps to ensure that the other controllers are notified of your erasure request.
- If they reject you or do not respond, you can file a complaint with the data protection authority (in Hungary, this is the NAIH) or turn to the courts.
An everyday example
You close your account at an online store and ask them to delete your profile, purchase history and newsletter subscription. They must delete the profile and marketing data, but they keep your invoices for the period required by law. You can likewise ask an AI chatbot provider to delete your past conversations.
Who is affected
A common misconception
Limits and risks
- You must send the request separately to every data controller; there is no single 'delete everywhere' button.
- Enforcement against providers outside the EU is more difficult. Removal from search engines typically applies only to searches initiated within the EU; results may still appear in other parts of the world.
- Targeted removal of data from trained AI models remains technically unreliable to this day, so providers often rely on filtering to prevent the model from outputting the data.
- Deletion cannot reach what others have already saved, forwarded or screenshotted.
Similar, but not the same
- withdrawal of consent – Withdrawal stops further data processing. If there is no other legal basis, the data controller must delete the data afterwards, and the right to erasure explicitly makes this enforceable.
- machine unlearning – This is a technical procedure for an AI model to 'forget' certain training data, whereas the right to erasure is a legal claim.
- anonymization – In such cases, the data remains but is no longer linked to you, whereas in deletion, the data itself ceases to exist.
Related concepts
data protection, GDPR, data subject rights
removal of search results, account deletion
machine unlearning, right of access, data portability, data efficiency, training data
A brief history
The right to erasure was already included in the 1995 EU data protection directive. Building on this, the Court of Justice of the European Union ruled in 2014 in the Google Spain case (C-131/12) that certain search results appearing in name searches could be requested for removal. The right was detailed in Article 17 of the GDPR, adopted in 2016 and applicable since May 2018, also known as the 'right to be forgotten'.
Where things stand
It is an established right in the EU, regularly enforced by authorities, and several data protection laws outside Europe have adopted similar provisions. By the end of 2026, the major open question is how to enforce it against already trained AI models and the persistent memory of agents.
Also known as
right to erasure · right to be forgotten · right to be forgotten · right to erasure · right to erasure · right to erasure · right to be forgotten · RTBF
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.