The GDPR right of individuals to have their personal data deleted in certain circumstances, also known as the right to be forgotten.
Under Article 17 of the GDPR, a person can ask an organization to erase their personal data, for example when it is no longer needed, consent is withdrawn, or it was processed unlawfully. The organization must comply unless an exemption applies, such as a legal obligation to retain the data.
Honoring erasure requires knowing where data lives, including backups and processors, which is why data mapping and retention controls matter.
Related frameworks
KaitoSec