Right to erasure — make them delete your data (Art. 17)

The right to erasure (Art. 17) makes organisations delete your personal data when one of six grounds applies — the big four in practice: the data is no longer necessary for the original purpose; you withdraw consent and no other legal basis exists; you object and they lack overriding grounds — for direct marketing the objection is absolute; or the processing was unlawful from the start. Not absolute: they may refuse where the data is needed for legal obligations (tax records!), legal claims, freedom of expression, or public-interest archiving. A shop can delete your marketing profile yet lawfully keep the invoice — for however long its national tax law requires. The ripple duty (Art. 17(2) & 19): whoever deletes must also inform recipients they shared your data with, and take reasonable steps to tell other controllers who republished it. Ask explicitly: “please confirm which recipients you have informed.” How to ask: one email — “Under Article 17 GDPR I request erasure of all my personal data. Ground: [no longer necessary / consent withdrawn / objection].” One month to comply, like all rights. Confirmation: request written confirmation of deletion, including from backups within their stated cycle. Google results about you are their own flow — see Remove me from Google.