Right to Be Forgotten
The Right to Be Forgotten, also known as the right to erasure, is a privacy principle under Article 17 of the GDPR that allows individuals to request the deletion of their personal data from an organization's systems.
What is Right to Be Forgotten?
Right to Be Forgotten (Right to Erasure) is a data privacy right established under Article 17 of the General Data Protection Regulation (GDPR). It enables individuals to request that an organization permanently erase their personal data from all systems, databases, and backups. The right is not absolute and applies only under specific circumstances, such as when the data is no longer necessary for the original purpose, consent is withdrawn, or the data was unlawfully processed.
Scope of deletion. When a Right to Be Forgotten request is fulfilled, the organization must delete not only the user's account and profile information but also any personal data stored in logs, analytics systems, CRM platforms, marketing databases, and third-party services under the organization's control. The only exception is when legal obligations (such as tax or financial record-keeping requirements) mandate data retention.
Implementation in CIAM systems. Customer Identity and Access Management (CIAM) platforms must support automated erasure workflows to handle Right to Be Forgotten requests efficiently. This includes cascading deletion across identity stores, activity logs, consent records, authentication history, and any derived or processed data. Organizations must also verify the requester's identity before processing to prevent fraudulent deletion requests.
Analogy
Right to Be Forgotten is like asking a library to permanently remove your borrowing history from its records. Once the library deletes it, there is no trace of which books you checked out, when you visited, or what you read — as if you never used the library at all.
Types and Use Cases
- GDPR compliance programs: Organizations operating in the EU or serving EU residents must implement processes to receive, verify, and fulfill Right to Erasure requests within the mandated 30-day window.
- Consumer data portals: Privacy-focused companies provide self-service portals where users can request data deletion directly, triggering automated erasure workflows.
- Post-account closure: When a user closes their account, the organization may offer a grace period for reactivation before permanently erasing all associated personal data.
- Marketing database cleansing: Individuals can request removal from marketing lists and CRM databases, ensuring their data is not retained for promotional purposes after consent is withdrawn.
How it Works
{
"erasureRequest": {
"userId": "usr_8f7e3d2a1b",
"requestType": "right_to_be_forgotten",
"requestDate": "2026-06-01T10:30:00Z"
},
"erasureScope": {
"profile": true,
"authenticationLogs": true,
"consentRecords": true,
"activityHistory": true,
"marketingData": true,
"paymentHistory": false,
"exceptionReason": "Legal retention requirement (tax records)"
},
"erasureStatus": "completed",
"completionDate": "2026-06-01T10:35:00Z"
}Right to Be Forgotten vs Data Portability
Right to Be Forgotten
Data Portability
Right to Be Forgotten requires organizations to permanently delete personal data upon request
while Data Portability requires organizations to export the user's data in a structured, machine-readable format for transfer to another provider.
Right to Be Forgotten is about data destruction and privacy protection
while Data Portability is about data mobility and user control over their information.
Right to Be Forgotten may conflict with legal retention obligations and requires careful exception handling
while Data Portability focuses on data format and accessibility standards.
Best Practices for Right to Be Forgotten
- Implement automated erasure workflows in your CIAM platform to handle deletion requests within regulatory timeframes (30 days under GDPR).
- Maintain a data map that documents all systems, databases, backups, and third-party services where personal data resides to ensure complete erasure.
- Verify requester identity rigorously before processing deletion requests to prevent unauthorized or fraudulent erasure of user data.
- Document exceptions and retain compliance records — if data cannot be deleted due to legal requirements, clearly document the reason and inform the requester.
How LoginRadius Powers Right to Be Forgotten
LoginRadius CIAM platform provides comprehensive support for Right to Be Forgotten compliance through automated data erasure APIs. Organizations can programmatically trigger deletion of user profiles, authentication history, consent records, and all associated personal data across the LoginRadius data stores. The platform maintains audit trails for every erasure request, helping organizations demonstrate compliance with GDPR Article 17 requirements during regulatory audits.
FAQs
No. The right has exceptions. Data can be retained when necessary for exercising freedom of expression, legal compliance, public health, archiving, or establishing legal claims. Organizations must evaluate each request against these exceptions and inform the requester of any data retained and the reasons.
Under GDPR, organizations must respond to a Right to Be Forgotten request without undue delay and within one month of receipt. This timeline can be extended by two additional months for complex or high-volume requests, but the requester must be informed of the extension within the initial month.
LoginRadius provides data erasure APIs and automated workflows that enable organizations to fulfill Right to Be Forgotten requests efficiently. The platform supports cascading deletion across user profiles, authentication logs, consent records, and activity data. LoginRadius also maintains detailed audit logs of erasure requests for compliance documentation.