An online shop, a streaming service or an old account holds your data, and you no longer want it stored there. The General Data Protection Regulation (GDPR) gives you a right for this that is often called the right to be forgotten. It is not unlimited, however. This guide explains when you can demand erasure, which deadlines apply and where the claim ends.
Short answer: Under Article 17 (1) GDPR you can request erasure of your personal data if one of the grounds listed there applies, for example because the purpose has lapsed or you have withdrawn consent. The controller must reply within one month, and this period can be extended by two months. Last updated: November 2026.
Key points
- The right to erasure is set out in Article 17 GDPR and requires one of the grounds named there.
- Typical grounds are that the purpose of the processing has lapsed, that consent has been withdrawn and that the processing was unlawful.
- The controller must answer your request within one month. In justified cases the period is extended by two months.
- There are exceptions, for example where processing is necessary to comply with a legal obligation.
- A request should be made in writing and state clearly which data should be deleted.
What does Article 17 GDPR require?
Article 17 (1) GDPR lists six grounds on which the data subject may demand erasure. First, the data are no longer necessary for the purposes for which they were collected. Second, the provision names the withdrawal of consent on which the processing was based, where there is no other legal ground for it. Third, the data subject objects to the processing and no overriding legitimate grounds exist.
Further grounds are unlawful processing, erasure required to comply with a legal obligation under Union or Member State law, and the collection of data from information society services under Article 8 (1). You therefore need not only express the wish but also be able to point to one of the grounds named.
Which data does the claim cover?
The claim relates to personal data, that is, information relating to an identified or identifiable person. This includes profile data such as name and address, usage logs, order data or comments under your name. Whether derived information such as interest profiles is covered depends on whether it can be linked to you.
Do not limit your request unnecessarily. If you want as much erased as possible, name the categories explicitly: account, order history, payment data, location history, marketing profiles and old newsletter registrations. A gap is then harder to justify later, and the provider has to answer each point separately.
When does the provider not have to erase the data?
Article 17 (3) GDPR names exceptions. Under it, paragraph 1 does not apply where the processing is necessary. These include exercising freedom of expression and information, compliance with a legal obligation or a task carried out in the public interest, reasons of public interest in the area of public health, archiving, research or statistical purposes, and the establishment, exercise or defence of legal claims.
| Exception under Art. 17 (3) | What it means for you in practice |
|---|---|
| Freedom of expression and information | A critical post about a person can stay online but must be examined |
| Legal obligation | Retention duties, for example for invoices, can limit erasure |
| Public interest in health | Mainly relevant for bodies processing health data |
| Archiving, research or statistics | Mostly concerns institutional processing, not private accounts |
| Legal claims | Data the provider needs to defend itself may be withheld |
The table shows that erasure is not always complete. The provider should, however, explain why it keeps certain data. Ask for such an explanation expressly if a reply is too general.
How long does the answer take?
Under Article 12 (3) GDPR, the controller must provide information on the measures taken on request without undue delay and in any event within one month of receiving the request. This period can be extended by a further two months where necessary, taking into account the complexity and number of requests. The controller must inform you within the first month of any extension and the reasons for the delay.
Record the date on which you sent your request. Without that date it is hard to prove whether the deadline was met. A receipt or proof of dispatch helps.
How to word an erasure request
A good request is short and precise. Give your name, the e-mail address or customer number you used and the service that holds the data. Ask expressly for erasure of all personal data linked to your account, or name the categories of data to be removed. State the ground you rely on, for example the withdrawal of your consent.
Also ask for confirmation of the erasure and for information about the recipients to whom the data were passed on, as far as known. Keep your request and all replies. If the provider does not respond, your proof is decisive for the next steps.
What if the provider does not erase the data?
If the deadline passes or the reply is inadequate, you can lodge a complaint with the competent data protection supervisory authority. The authority examines the matter. Whether a claim to damages exists depends on the individual case and is assessed separately, as explained in the guide on Schadensersatz nach einem Datenschutzverstoß (in German).
For a first step, a factual reminder letter that refers to the one-month deadline is often enough. A lawyer is usually only needed if the provider refuses erasure and you want to examine further claims.
Frequently asked questions
Must I give a reason?
You should name one of the grounds in Article 17 (1), so that the request is clearly justified. A detailed justification is not always necessary, but a reference to the ground makes processing easier and shows what you rely on.
Does the request cost anything?
If in doubt, ask whether any costs arise for the information or the erasure before you make any payment. A payment should only be made against a written demand that you can understand.
Does this close my account automatically?
No. Erasing data and terminating a contract are two different steps. Cancel a subscription or account separately if you no longer want to use it. The guide on deleting social media profiles explains the process for those accounts (in German).
Does the right also apply to public authorities?
The GDPR applies to controllers within its scope. Public authorities are also subject to special rules that must be checked in each case. A request to an authority often follows its own procedure.
What to do now
- Find out which service processes your data and review its privacy policy.
- Write a request in writing that refers to a ground under Article 17 GDPR.
- Document the dispatch and treat the one-month deadline as a checkpoint.
- Complain to the data protection authority if the provider does not respond or responds inadequately.
Related guides
- Digital Rights in Everyday Life: An Overview for Students
- Auskunftsanspruch nach DSGVO: Welche Daten Unternehmen über dich speichern
- Data breach at a service: what you should do now
- Konto endgültig löschen: So entfernst du Social-Media-Profile
- Sprachaufnahmen löschen: So gehst du mit Sprachassistenten-Daten um (in German)
Sources: Article 17 GDPR, dejure.org, accessed November 2026 (EU text), Article 12 GDPR, gesetze.legal, accessed November 2026 (EU text)
Last updated: November 2026. This guide is general information, not individual advice.
