Right to Erasure

The right to erasure (also called the right to be forgotten) is a privacy right under GDPR (Article 17) that allows individuals to request the deletion of their personal data when it is no longer necessary for the purpose it was collected, when they withdraw consent, or when they object to its processing.

Organizations must respond to erasure requests within 30 days and delete the personal data from all systems - including backups, analytics databases, and any third-party processors they have shared the data with. Failure to comply can result in GDPR enforcement action.

Building systems that can honor erasure requests requires knowing exactly where every piece of personal data lives across your stack. This is why data lineage and a comprehensive data catalog are not just nice-to-haves - they are operational requirements for any organization handling significant volumes of personal data.