GDPR Article 17 explained: your right to erasure

Article 17 of the General Data Protection Regulation gives you the right to have personal data about you erased. It is one of the most powerful consumer-protection tools in the world, and most people never use it because they assume it is theoretical. It is not. It is enforceable, it has deadlines, and it applies to almost every company holding your data.

What you can actually demand

You can ask any organisation to erase your personal data when one of several conditions applies. The most common in practice are simple: the data is no longer needed for the purpose it was collected, you withdraw the consent it relied on, or you object and there is no overriding legitimate reason to keep it.

• The data is no longer necessary for the original purpose.
• You withdraw consent and there is no other legal basis.
• You object to the processing and no overriding legitimate grounds exist.
• The data was processed unlawfully.
• Erasure is required to comply with a legal obligation.

Who has to comply

Any data controller processing the personal data of people in the EU, regardless of where the company itself is based. A people-search site in another country that profiles EU residents is squarely in scope. That is the lever that makes erasure requests effective even against brokers that feel out of reach.

The one-month clock

Once you make a valid request, the controller has one calendar month to respond. They can extend it by two further months for genuinely complex cases, but they have to tell you within the first month and explain why. Silence is not an option they are allowed. If the month passes with no response, that itself is a breach you can complain about.

The limits, honestly stated

Article 17 is not absolute. A controller can refuse where keeping the data is necessary for freedom of expression, for compliance with a legal obligation, for a public-interest task, or for the establishment or defence of legal claims. A bank cannot erase records it is legally required to retain. But a broker selling your address has no such shield, and saying no without a lawful basis is itself unlawful.

How to use it

Put the request in writing, state plainly that you are exercising your right to erasure under Article 17, and keep the date. If they miss the deadline or refuse without a valid ground, you escalate to your data protection authority under Article 77. You do not need a lawyer and there is no fee. The law already did the hard part.