An individual's right to request that an organization delete their personal data, also known as the right to be forgotten.
The right to erasure allows individuals to ask organizations to delete personal data about them in certain circumstances — for example, when the data is no longer necessary for the purpose it was collected, when consent is withdrawn, or when the data was processed unlawfully.
This right is explicitly established in GDPR (Article 17). In Canada, PIPEDA does not include an explicit right to erasure, but individuals can withdraw consent for the use of their personal information, which may require the organization to stop using or delete it. Canadian privacy law reform discussions have included proposals to add a more explicit erasure right.
The right to erasure is not absolute. Organizations may retain data when required by law, for public interest purposes, or for the establishment, exercise, or defence of legal claims.
Example: A person who created an account on a website years ago wants all their data deleted. Under GDPR, they can submit an erasure request. The organization must delete the data unless it has a legal basis to retain it — such as an ongoing contractual obligation or a legal requirement to keep records.
This is educational information, not legal advice.