Can I demand erasure of my data (right to be forgotten)?
It depends: you have a right to demand erasure, but not always and not everywhere. The right to be forgotten (art. 17 GDPR) lets you demand a controller erase your personal data in defined situations: when the data are no longer needed for the purposes they were collected for; when you withdrew consent (and there's no other basis); when you raised an effective objection; when the data were processed unlawfully; or when erasure follows from a legal duty. The controller should erase the data without undue delay. This right is not absolute, though — it doesn't apply where processing is needed to exercise freedom of expression, fulfil a legal duty (e.g. keeping accounting records), establish or pursue claims, for public health or archival purposes. You file the request with the controller, and a complaint with UODO.
📋 The rules
- Right to erasure under art. 17 GDPR
- Data not needed, withdrawn consent, effective objection
- Unlawful processing: a basis for erasure
- The controller erases data without undue delay
- The right is not absolute — there are exceptions
🔓 Exceptions
- Legal duty to keep data (e.g. accounting, tax documents)
- Freedom of expression and information, and archival/research purposes
- Establishing, pursuing or defending claims, public health
⚠️ Penalties & fines
A controller who unjustifiably refuses erasure or ignores the request breaches GDPR — you can file a complaint with the President of UODO, who can impose a penalty, and you're also entitled to compensation for harm. Remember, though, the right to be forgotten has limits: if an exception applies (e.g. the data are needed for tax settlements or pursuing claims), the controller needn't erase them — but may restrict their use. To exercise the right: file a request with the controller (state which data and on what basis you seek erasure), keep confirmation, and on refusal or no response in time (usually a month) file a complaint with UODO.
📎 Official sources
- GDPR · Regulation (EU) 2016/679 (art. 17) →
- UODO · Right to erasure of data →
- Gov.pl · Personal data protection →
❓ Frequently asked
What is the right to be forgotten?
It's the right, under art. 17 GDPR, to demand erasure of your personal data in defined situations — e.g. when the data are no longer needed, you withdrew consent, raised an effective objection, or the data were processed unlawfully. The controller should erase them without undue delay.
When can I demand erasure of data?
Among others, when the data are no longer needed for the purpose they were collected for; when you withdrew consent and there's no other basis; when you raised an effective objection; when the data were processed unlawfully; or when erasure follows from a legal duty on the controller.
Must the controller always erase data?
No. The right to be forgotten isn't absolute. The controller can refuse where an exception applies — including a legal duty to keep data (e.g. accounting documents), exercising freedom of expression, archival purposes, or establishing and pursuing claims.
How do I file a request for erasure?
Send the request to the data controller — state which data and on what basis you seek erasure. Keep confirmation of filing. The controller should respond and act on the request as a rule without undue delay, within a month at the latest.
What if the controller refuses to erase data?
If the refusal is unjustified or the controller doesn't respond, you can file a complaint with the President of UODO, who examines such cases and can impose a penalty. You're also entitled to compensation for harm. It's worth keeping the request and the controller's reply as evidence.
🔎 Common searches
What people search to land here:
- “right to be forgotten gdpr”
- “how to erase my personal data”
- “art 17 gdpr data erasure”
- “when must controller erase data”
- “complaint to uodo data erasure”
- “right to be forgotten exceptions”