What is the right to erasure (“right to be forgotten”)?;
Still have a question, spotted an error, or have a better explanation or a source we should cite?
When someone asks you to delete their data under GDPR Article 17, they're exercising the right to erasure. It's sometimes called the "right to be forgotten," and for email marketers it's one of the most important data subject rights to understand correctly.
There's a nuance that trips people up: deleting and suppressing aren't the same thing, and you often need to do both.
If someone asks you to delete their data, you delete their profile: their name, email address, behavioral data, everything you hold on them. But if you delete without suppressing, there's nothing to prevent you from accidentally collecting their email again through a signup form and emailing them. That would be a compliance failure.
So the correct process is: delete the personal data and add the email address to a suppression list that prevents future contact. The suppression list doesn't need to store their full profile, just enough to prevent re-entry.
The right to erasure isn't absolute. You don't have to delete data if you have a legitimate reason to keep it, such as a legal obligation (like tax records), a contract that requires it, or where the data is necessary for legal claims. These exceptions are narrow and should be applied carefully.
You have one month to comply. When you do, you should notify any sub-processors who hold a copy of that person's data as well.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
