Quick answer
The right to erasure (right to be forgotten) under Article 17 UK GDPR lets you ask an organisation to delete your personal data, for example where it is no longer needed, you withdraw consent, or you object successfully. Make the request verbally or in writing; the organisation must respond within one month. It can refuse where data is needed for legal claims or required by law.
Last reviewed: June 2026 · For use in England & Wales · eLitigant is a Community Interest Company (No. 16566612), not a law firm. Always check the current official form on GOV.UK before you file, and sign the statement of truth yourself.
① Draft it from scratch
Give Chris the controller, the data and the original purpose. He drafts your Article 17 erasure request with ground-specific framing, exemption rebuttals and the escalation path.
② Check the draft you’ve written
Already written your request? Upload it. Chris reviews it against the Article 17 grounds and the Article 17(3) exemptions, and shows you where it can be tightened.
③ You’ve had a refusal — respond
Run the controller’s refusal by Chris. He reads it against your own documents, tests the exemption claimed, and frames your ICO complaint.
In short: The right to erasure (“right to be forgotten”) under Article 17 UK GDPR lets you require a data controller to delete your personal data on one of six grounds — for example where the data is no longer necessary, consent has been withdrawn, an Article 21 objection is upheld, or the data was unlawfully processed — unless an Article 17(3) exemption applies. eLitigant drafts your erasure request (or checks the draft you’ve written, or reads a refusal you’ve received) with ground-specific framing, exemption rebuttals and the ICO escalation path — you remain the litigant in person.
The right to erasure — “right to be forgotten” — is narrower than the headlines suggest, but wider than controllers claim. Article 17 UK GDPR sets out specific grounds, and controllers who refuse without reason find themselves on the wrong side of an ICO complaint.
The six grounds
Article 17(1) sets out when erasure applies:
- (a) Data no longer necessary for the purpose originally collected
- (b) Consent withdrawn and no other legal basis
- (c) Objection under Article 21 upheld
- (d) Unlawfully processed
- (e) Legal obligation to erase under UK/EU law
- (f) Data collected in relation to information society services offered to a child
The exemptions
Article 17(3) exempts where processing is necessary for:
- Freedom of expression and information
- Compliance with legal obligation
- Public interest in public health
- Archiving / scientific / historical research / statistics
- Establishment, exercise, or defence of legal claims
Google and search engines
Google Spain C-131/12 established the right to de-index search results. Google provides a removal form. Refusals can be challenged to the ICO. Criteria: relevance, currency, public figure status, role played at the time.
Employer records
Most employer retention periods (HMRC 6 years, pension 40+ years, safeguarding indefinite for children) will defeat erasure. What can usually be erased: photographs, performance reviews beyond retention period, internal gossip emails, marketing consent records once withdrawn.
Let Chris draft this for you
UK GDPR is precise. The remedy windows are fixed. Chris drafts SARs, ICO complaints, erasure requests, and Article 82 damages claims with the statutory scaffolding that makes controllers respond properly.
Structure — the Litigant Standard
1. Identify the data
Specific records, categories, time periods, locations in the controller’s systems.
2. The ground
“I request erasure under Article 17(1)(a) UK GDPR because the data is no longer necessary for the original purpose of [X].”
3. Address anticipated exemptions
“There is no applicable exemption under Article 17(3) because [reason].”
4. Downstream notification
“Under Article 19 UK GDPR, please notify any third parties to whom the data was disclosed.”
5. Timeline and escalation
“One-month response period under Article 12(3). ICO complaint will follow non-compliance.”
Can Chris draft erasure requests?
Yes. Upload the controller details, the data concerned, original purpose, any correspondence. Chris drafts erasure requests with ground-specific framing, exemption rebuttals, and escalation path.
Prepare to win. Plan not to fail.
Data minimisation is a principle. Erasure is its teeth. Chris drafts the bite.
The GDPR request forms
Subject access request (SAR) form · erasure request form · ICO complaint form
Frequently asked questions
What is the right to erasure under Article 17?
It is the “right to be forgotten.” Article 17(1) UK GDPR sets out specific grounds on which you can require a controller to delete your personal data — it is narrower than the headlines suggest, but wider than many controllers claim.
What are the grounds for erasure?
Article 17(1) lists six: the data is no longer necessary for the purpose originally collected; consent is withdrawn and there is no other legal basis; an objection under Article 21 is upheld; the data was unlawfully processed; there is a legal obligation to erase; or the data was collected from a child in relation to information society services.
When can a controller refuse?
Article 17(3) exempts processing that is necessary for freedom of expression and information, compliance with a legal obligation, public interest in public health, archiving or scientific/historical research/statistics, or the establishment, exercise or defence of legal claims. A good request anticipates and rebuts the exemption likely to be raised.
Can I get search results removed from Google?
Google Spain (C-131/12) established the right to de-index search results, and Google provides a removal form. Refusals can be challenged to the ICO, with criteria including relevance, currency, public-figure status and the role played at the time.
Can my employer be made to erase my records?
Often not — retention periods (such as HMRC and pension obligations, and safeguarding records) will frequently defeat erasure. But items like photographs, performance reviews held beyond their retention period, internal gossip emails and withdrawn marketing-consent records can usually be erased.
How fast must a controller respond?
The request triggers a one-month response period under Article 12(3) UK GDPR. Where the controller has disclosed the data to others, Article 19 requires it to notify those third parties. Non-compliance can be escalated by way of an ICO complaint.
Get your erasure request drafted properly
Chris drafts erasure requests, SARs, ICO complaints and Article 82 damages claims — or reads a refusal you’ve received against your own documents and shows you where you stand.
One day · one matter · unlimited drafts · no subscription · you remain the litigant in person.
Related guides: ICO Complaint — Data Protection Guide · Personal Data Breach Compensation — Article 82 Guide · All civil court forms