Skip to content

Erasure Request

What is Erasure Request?

A formal request from a data subject asking an organization to delete their personal data, triggering an obligation to comply unless exemptions apply.

Privacy and Data Protection

What the standards actually require on erasure request

Requirements naming erasure request across 4 standards, quoted from the control text.

On an erasure request the controller first establishes whether an Article 17(1) ground applies (data no longer necessary, including after a prior Article 21(6) objection; consent withdrawn, after which data must be erased absent another basis;

edpb-guidelines-1-2026-on-processing-of-personal-data-for-scientific-research-purposes::6.2 · 6.2 Erasure requests: test the Article 17(1) grounds, then the Article 17(3)(d) exception restrictively and case by case, and warn of it in advance →

The controller must tell the data subject in writing, without undue delay and within the applicable time period, whether a rectification, erasure or restriction request is granted and, if refused, the reasons and the rights to ask the Commissioner to check, co...

uk-data-protection-act-2018::s.48 · Section 48 Rectification and erasure requests: decisions and notifications →

The controller must erase personal data without undue delay where they are no longer needed, consent is withdrawn and no other basis exists, the data subject objects under Article 21(1) with no overriding grounds or objects to direct marketing, the processing...

uk-gdpr-uk-general-data-protection-regulation::Art.17 · Article 17 Right to erasure ('right to be forgotten') →

The head of an institution designates a data protection officer; every person, institution or public body whose activities involve regular and systematic large-scale monitoring or whose core activities involve special personal data must designate one, trained,...

uganda-data-protection-and-privacy-act-2019::s6 · Data protection officer →

Questions people ask about erasure request

What is Erasure Request?
A formal request from a data subject asking an organization to delete their personal data, triggering an obligation to comply unless exemptions apply.
Why is Erasure Request important for compliance?
Erasure Request is a key concept in Privacy and Data Protection. Understanding erasure request helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Erasure Request?
Erasure Request appears in the requirement text of EDPB Guidelines 1/2026 on processing of personal data for scientific research purposes, UK Data Protection Act 2018, UK GDPR (UK General Data Protection Regulation), Uganda Data Protection and Privacy Act (2019). Across these standards we have identified 4 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Erasure Request?
Explore our compliance framework pages to see how erasure request applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Erasure Request applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Written and maintained by Gerard Blokdyk, The Art of Service.