Right to Be Forgotten & Erasure Specifics
When the Right to Erasure Does Not Apply
Erasure is a real right, but it is not unconditional. Knowing the lawful exceptions helps you read a refusal calmly and decide what to do next.
In short
The right to erasure under UK GDPR is qualified, not absolute. An organisation can lawfully keep your data when it is needed to meet a legal obligation, exercise free expression, support a legal claim, serve the public interest in health or archiving, or where erasure would not yet apply because another lawful basis still stands.
A qualified right, not an off switch
The right to erasure, sometimes called the right to be forgotten, lets you ask an organisation to delete personal data it holds about you. It is a genuine right under Article 17 of the UK GDPR. What it is not is an absolute one. The law builds in specific situations where a controller can decline, in whole or in part, and still be acting correctly.
This matters because a refused erasure request is not automatically a sign that something has gone wrong. Often it means the data falls into one of the recognised exceptions, or that the right has not been triggered in the first place because a separate lawful reason to hold the data still applies. Reading the refusal against the exceptions is the calm first step.
This is general information, not legal advice. The exact wording, the regulator, and the named exceptions vary by jurisdiction. The framing here follows UK GDPR and the Information Commissioner's Office; if your matter sits elsewhere, the equivalent law and regulator apply.
The lawful reasons an organisation can keep your data
The UK GDPR lists the grounds on which an organisation may refuse an erasure request. These are not loopholes invented by the controller. They are written into the law to balance your right against other legitimate needs, and a refusal should point to one of them.
The most common grounds are set out below. An organisation relying on one should be able to tell you which it is and why it fits your data, rather than refusing in vague terms.
- Legal obligation: the organisation is required by law to keep the data, for example tax, accounting, or employment records held for a set retention period.
- Exercise of free expression and information: data held for journalism, or for academic, artistic, or literary purposes, has stronger protection from erasure.
- Public interest in public health, or for archiving, scientific or historical research, or statistics, where deletion would seriously impair that work.
- Establishment, exercise, or defence of legal claims: data needed for a current or anticipated legal matter can be retained while that need lasts.
- The right has not been triggered: erasure mainly applies when data is no longer needed, consent is withdrawn with no other basis, or the data was processed unlawfully. If a valid lawful basis still stands, the deletion duty may not arise yet.
How to read a refusal and decide your next move
When an organisation declines an erasure request, it should explain which exception it relies on and confirm your right to complain. A clear, specific reason that maps to one of the lawful grounds is a sign the process is working as the law intends, even if the answer is not the one you wanted.
A vague refusal, no reason at all, silence past the response deadline, or a blanket claim that nothing can ever be deleted is different. In those cases you can ask the organisation to clarify which exception applies and to delete anything outside it, because an exception usually covers a specific category of data, not your whole record.
If you remain unsatisfied, you can raise the matter with the relevant regulator, which for the UK is the Information Commissioner's Office. OSINTA helps you understand your own footprint and prepare your own requests; the decision to send, escalate, or accept a response is always yours. This remains general information, not legal advice.
Frequently asked questions
Is the right to erasure absolute?
No. Under UK GDPR it is a qualified right. An organisation can lawfully keep your data where a listed exception applies, such as a legal retention duty, free expression, public-interest research, or the defence of a legal claim. A refusal grounded in one of these is acting within the law.
Can a company keep my data because the law requires it?
Yes. If another law obliges the organisation to retain certain records, for example tax, accounting, or some employment data, it can decline to erase that data for as long as the obligation lasts. It should still delete anything the obligation does not cover.
What if the refusal gives no clear reason?
A proper refusal should name the exception relied on and confirm your right to complain. If it is vague, silent, or claims nothing can ever be deleted, you can ask which exception applies and request deletion of anything outside it, then raise the matter with your regulator, the ICO in the UK.
Does an exception mean none of my data gets deleted?
Not usually. Exceptions tend to cover a specific category of data, such as records held for a legal duty, rather than your whole file. Data that falls outside the exception can still be erased, so it is worth asking for a partial deletion.
Related terms
This is general information, not legal advice. For guidance on your own situation, consider speaking with a qualified professional.
Reviewed by OSINTA's founding lawyer — 2026-06-27.
Understand your footprint before you ask for erasure
See what an organisation may hold first, so an erasure request and any refusal are easier to read.