What triggers the right to erasure under Article 17(1)?
Article 17(1) is triggered when one of six listed grounds applies, and the data subject then has the right to obtain erasure of personal data without undue delay unless an Article 17(3) exception prevents that result to the extent processing is necessary.
The six grounds are specific and should be checked one by one. Article 17(1)(a) applies where “the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.” Article 17(1)(b) applies where “the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing.”
Article 17(1)(c) applies where “the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).” Article 17(1)(d) applies where “the personal data have been unlawfully processed.” Article 17(1)(e) applies where “the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.” Article 17(1)(f) applies where “the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).”
For exam purposes, do not collapse these grounds into a general fairness test — Article 17 works by listed triggers. Also keep Article 17(1)(c) narrow and accurate: this article does not rework the full balancing analysis, which is covered in our legitimate interest and right to object guide.
- 17(1)(a): no longer necessary for the purposes
- 17(1)(b): consent withdrawn and no other legal ground
- 17(1)(c): valid objection under the Article 21 route
- 17(1)(d): unlawful processing
- 17(1)(e): erasure required by Union or Member State law
- 17(1)(f): data collected in relation to Article 8(1) information society services
How does Article 17(1)(c) connect to the right to object?
Article 17(1)(c) connects erasure to objection by making erasure available where the data subject objects under Article 21(1) and there are no overriding legitimate grounds, or where the data subject objects under Article 21(2).
The cross-reference is express. Article 21(1) states: “The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1)… The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.”
In Article 17 terms, an objection can become a route to erasure, but only through the wording of Article 17(1)(c). For revision, remember the sequence: objection first, then assess whether the controller has overriding or compelling grounds, and only then ask whether Article 17(1)(c) is satisfied. For the deeper objection analysis, including the EDPB balancing-test factors, see our legitimate interest guide.
- Article 17(1)(c) is a cross-reference, not a standalone balancing rule.
- Do not treat every objection as automatic erasure.
- Keep the legal-claims wording in mind when reading Article 21(1).
What does the “right to be forgotten” mean in Article 17(2)?
Article 17(2) means that if a controller made personal data public and is already obliged to erase it under Article 17(1), the controller must take reasonable steps, including technical measures, to inform other controllers processing that data about the erasure request for links, copies or replications.
This is the specific public-data extension of the right to erasure. The trigger is not every erasure request — it applies where the controller has made the personal data public and is obliged under paragraph 1 to erase it. Only then does the extra duty arise.
The controller must act “taking account of available technology and the cost of implementation” and must “take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.” That is a reasonable-steps duty, not a guarantee of universal removal. Recital 66 gives context: the right to be forgotten was strengthened to include an obligation on the controller who made the data public to inform other controllers to erase links, copies or replications, “taking into account available technology and the means available to the controller, including technical measures.”
- Article 17(2) only applies if the controller made the data public.
- It depends on an existing duty to erase under Article 17(1).
- The duty is to take reasonable steps, not to guarantee total deletion everywhere.
- Links, copies and replications are expressly mentioned.
What is the difference between Article 17(2) and Article 19?
Article 17(2) is the specific public-data duty to take reasonable steps to inform other controllers about links, copies or replications, while Article 19 is the general duty to communicate rectification, erasure or restriction to each recipient to whom the personal data were disclosed, unless impossible or disproportionate.
This distinction is a classic exam trap, because both provisions involve telling others about a change, but they do different jobs. Article 17(2) is narrow and special: it concerns public data, applies only where the controller is already obliged to erase under Article 17(1), and focuses on informing controllers which are processing the personal data about erasure of links, copies or replications.
Article 19 is broader in some ways and different in others. It requires the controller to “communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.” The controller must also inform the data subject about those recipients if the data subject requests it. The clean memory aid: Article 17(2) is about publicity and reasonable steps; Article 19 is about disclosures and recipient notification. Article 17(2) is not the general notification rule, and Article 19 is not limited to public data or to erasure alone.
When do the Article 17(3) exceptions block erasure?
Article 17(3) blocks paragraphs 1 and 2 to the extent processing is necessary for one of five listed reasons, so erasure is not absolute even where an Article 17(1) ground would otherwise be made out.
Article 17(3)(a) applies “for exercising the right of freedom of expression and information.” Article 17(3)(b) applies “for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”
Article 17(3)(c) applies “for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3).” Article 17(3)(d) applies “for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing.” Article 17(3)(e) applies “for the establishment, exercise or defence of legal claims.”
The phrase “to the extent processing is necessary” matters: it ties the exception to necessity, not to a broad preference for keeping data. Always test the Article 17(1) ground first, then ask whether one of these exceptions displaces erasure for the necessary processing.
- 17(3)(a): freedom of expression and information
- 17(3)(b): legal obligation, public interest task, or official authority
- 17(3)(c): public interest in public health
- 17(3)(d): archiving, research, or statistics under Article 89(1)
- 17(3)(e): establishment, exercise or defence of legal claims
What is the deadline for responding to an erasure request?
The controller must act on an Article 17 request without undue delay and in any event within one month of receipt, with a possible two-month extension for complex or numerous requests if the data subject is informed within one month and given reasons.
The timing rule comes from Article 12(3), which applies generally to data subject rights requests. For practitioners, that means Article 17 requests should be triaged and tracked in the same operational workflow as other rights requests, including a subject access request under Article 15.
The safest exam answer states the full rule accurately: act “without undue delay and in any event within one month of receipt of the request.” The period may be extended by two further months for complex or numerous requests, but the data subject must be informed of the extension and the reasons within one month. In practice, complete the legal analysis in a structured order: identify the Article 17(1) ground, check whether any Article 17(3) exception applies, then consider whether Article 17(2) and/or Article 19 create additional communication duties.
What are the main exam traps and practical takeaways for Article 17?
The main Article 17 traps are treating erasure as automatic, confusing Article 17(2) with Article 19, and forgetting that Article 17(3) can disapply paragraphs 1 and 2 to the extent processing is necessary.
First, do not answer Article 17 as if it were a general right to deletion on demand — the right arises only where one of the six Article 17(1) grounds applies. Second, do not skip the exceptions: Article 17(3) can stop erasure even after a ground is identified.
Third, keep the notification duties separate. If the facts say the controller made the data public, think about Article 17(2) and its reasonable steps standard. If the facts say the data were disclosed to recipients, think about Article 19 and its duty to communicate rectification, erasure or restriction to each recipient unless impossible or disproportionate. Finally, if the scenario mentions an objection, remember that Article 17(1)(c) is the bridge provision — a concise cross-reference to the Article 21 balancing test is usually the cleanest practitioner and exam approach.
- Start with the Article 17(1) trigger.
- Then test the Article 17(3) exceptions.
- Separate public-data duties (Art. 17(2)) from recipient-notification duties (Art. 19).
- Use the Article 12(3) timing rule for response handling.
- Treat Article 17(1)(c) as linked to Article 21, not as a standalone rule.
Article 17(2) vs Article 19 at a glance
| Feature | Article 17(2) | Article 19 |
|---|---|---|
| Main purpose | Public-data extension of erasure; inform other controllers about links, copies or replications. | General communication duty for rectification, erasure or restriction. |
| Trigger | Controller made the personal data public and is obliged under Article 17(1) to erase it. | Rectification, erasure or restriction carried out under Article 16, Article 17(1) or Article 18. |
| Who must be informed | Controllers which are processing the personal data. | Each recipient to whom the personal data have been disclosed. |
| Type of duty | Take reasonable steps, including technical measures. | Communicate the change unless impossible or disproportionate effort. |
| Scope | Specific to public data and erasure context. | Not limited to public data and not limited to erasure. |
| Extra point | Takes account of available technology and the cost of implementation. | Controller must inform the data subject about recipients if requested. |
Frequently asked questions
Is the right to erasure absolute under GDPR Article 17?
No. Article 17(1) gives a right to obtain erasure without undue delay where one of the listed grounds applies, but Article 17(3) says paragraphs 1 and 2 do not apply to the extent processing is necessary for one of five listed exceptions.
Does Article 17(2) require a controller to guarantee removal everywhere on the internet?
No. Article 17(2) requires the controller, taking account of available technology and the cost of implementation, to take reasonable steps, including technical measures, to inform controllers processing the data about erasure of links, copies or replications.
Is Article 19 the same thing as the right to be forgotten?
No. Article 19 is the general duty to communicate rectification, erasure or restriction to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Article 17(2) is the specific public-data extension tied to erasure.
What is the response deadline for an Article 17 request?
Under Article 12(3), the controller must act without undue delay and in any event within one month of receipt of the request. That can be extended by two further months for complex or numerous requests if the data subject is informed within one month and given the reasons.
Preparing for a DPO / GDPR certification exam?
GDPR Exam Trainer turns material like this into hundreds of practice questions, chapter training and a timed exam simulation, with AI explanations for every answer.
Create your free accountNo in-person course required · Cancel anytime.