Closing an account or unsubscribing from a marketing newsletter in Europe doesn't automatically mean a company wipes your information from its servers, backups, and analytics history. Many organisations retain personal data indefinitely, quietly building commercial profiles, unless you explicitly invoke your legal rights. Article 17 of the GDPR enshrines the Right to Erasure — popularly known as the "right to be forgotten."
What the right actually gives you
You have the legal power to require an organisation to permanently delete your personal data from its active databases and secondary storage systems — not just deactivate your account while quietly retaining the underlying data.
The response deadline — and an important correction on "30 days"
Once a company receives your erasure request, the standard deadline is one month. But this isn't a strict, non-extendable cutoff: under Article 12(3), the company can extend this by up to two further months for complex requests or where it's received numerous requests at once — a total maximum of three months. If they do extend, they must tell you within the first month, explaining why. A company that goes silent past one month without notifying you of a valid extension is in breach; one that properly notifies you of a complex-request extension is not.
When a company can legitimately refuse
This right isn't absolute. Companies can lawfully decline to delete specific data where a superseding legal obligation exists — tax law requiring billing records to be kept for 5-10 years, for instance, or health records — or where the data is necessary for exercising freedom of expression or defending against legal claims.
Making your request properly
Write a formal notice to the company's privacy officer using precise legal language: "I hereby exercise my Right to Erasure under Article 17 of the GDPR..." Specify clearly whether you want total deletion of all data linked to your identity, or only a specific dataset.
Downstream deletion — third parties matter too
If the company has made your personal data public or shared it with third-party processors (analytics tools, advertising networks), it's legally obligated to take reasonable technical steps to inform those third parties that you've requested erasure of any links, copies, or replications of your data.
Sources
- Regulation (EU) 2016/679 (GDPR) — Article 17 (right to erasure), Article 12(3) (response deadline and extension)
- European Data Protection Board — guidance on the right to erasure