Right to be forgotten: what it means for a small company's website

The right to be forgotten is the everyday name for the right to erasure. Under GDPR Article 17, and the UK GDPR’s version of it, a person can ask you to delete the personal data you hold about them. In a set list of situations you have to do it, and the clock runs for a month.

It has grounds and it has exceptions, so nobody gets to vanish from the internet with one email. For a small company the hard part is usually the mailbox nobody checks, or the privacy page that never says how to ask.

This guide covers when the right applies, when it doesn’t, how to handle a request step by step, and what your website should offer. There’s a short section on the US at the end, where the picture is different.

The right to be forgotten in simple terms

Article 17 says a person has the right to have their personal data erased without undue delay, and that you have to erase it when one of six grounds applies. The heading in the law reads “Right to erasure (‘right to be forgotten’)”. The two names cover the same article.

People often picture a search engine taking down links to pages about someone. That’s one branch of it. For a company with a website, the everyday version is simpler: someone who signed up, bought something or wrote to support wants their details gone.

When the right to erasure applies

Article 17(1) lists the grounds. In plain terms, a person can ask you to erase their data when:

• You don’t need it any more: the data is no longer necessary for the purpose you collected it for.
• They withdraw consent: you relied on consent, they take it back, and you have no other legal ground.
• They object: they object to processing based on legitimate interests and nothing overrides their objection, or they object to direct marketing. The marketing objection always wins.
• The processing had no proper basis in the first place.
• A law tells you to erase it.
• The data came from a child using an online service.

The ICO’s guidance adds a practical point: the right applies to data you hold when the request is received. It isn’t a promise never to collect anything about that person again, though it’s wise to keep a note so you don’t re-add them to a marketing list.

When you can say no

The right isn’t absolute. Article 17(3) sets out five exceptions. You can keep data when the processing is necessary:

• For freedom of expression and information. A news article is the classic case.
• To comply with a legal obligation. Tax rules in most countries say to keep invoices for years, and that beats an erasure request, for the invoice.
• For a task in the public interest or official authority.
• For archiving, research or statistics in the public interest, where erasure would seriously impair that work.
• For the establishment, exercise or defence of legal claims.

The exception covers the data that falls under it, not the whole record. Keep the invoice, delete the marketing profile. The ICO also says you can refuse a request that is manifestly unfounded or excessive, judged case by case, never as a blanket policy. If you refuse, tell the person within a month, with your reasons and their right to complain to the regulator and go to court. That’s Article 12(4).

Regulators have been looking at how exceptions get used. In its 2025 coordinated action, the European Data Protection Board reported that for some organisations exceptions are treated as automatically applicable without conducting a case-by-case assessment, and that refusals citing freedom of expression often came without a documented balancing assessment.

How a small company handles a request

The ICO says a request can be made verbally or in writing, to any part of the organisation, and it doesn’t have to mention Article 17. So the first job is recognising one. Here’s the order of work:

1. Log the date it arrived. The one-month clock in Article 12(3) starts on receipt. You can extend by two further months for complex or repeated requests, but you have to tell the person within the first month.
2. Check identity only if you have reasonable doubts, and ask for no more than you need. Someone writing from the email address on their account has usually shown enough.
3. Decide whether a ground applies, and whether an exception does. Note which.
4. Find the data. Your CRM, your email marketing tool, your shop platform, your support inbox, your spreadsheets. A short written list of where customer data lives makes this a ten-minute job rather than a week.
5. Delete it, backups included. The ICO’s position is that backup data has to be put beyond use, even where it can’t be overwritten at once, and the person should be told what happens to it. How long a backup may lag behind the live system is a question nobody has answered yet. The EDPB’s report lists it as something the authorities may need to explain, so for now, say what your backup cycle is and stick to it.
6. Tell anyone you shared it with. Article 19 asks you to communicate the erasure to each recipient unless that proves impossible or involves disproportionate effort. Your email tool and your payment provider count.
7. Reply. Say what you deleted, what you kept and why. Don’t charge: Article 12(5) says free of charge, in all but unfounded or excessive cases.

The EDPB’s 2025 action ran across 32 authorities and gathered answers from 764 organisations. The first problem it lists is the absence of a documented procedure. Its advice: set one up with clear deadlines and steps, and decide who does what.

What your website should offer

Three things, and the privacy notice carries all of them.

A route. Say in plain words that people can ask for erasure, and how. The EDPB found that some controllers do not explain to data subjects the procedure that has to be followed to submit a request for erasure, and that the gap showed up most in smaller organisations that had received few requests. One sentence fixes it: “To ask us to delete your data, email privacy@yourcompany.”

A contact that works. Three recent decisions show the failure mode. In June 2023 the Romanian authority fined the operator of eMAG 148,830 lei, about €30,000, after erasure requests sent to several addresses and a contact form were rejected by the company’s servers as untrusted. In February 2026 the Italian Garante fined a local news publisher €10,000 after a request went unanswered: one address had been inactive for years and the other was purged every six months. In its Noi Compriamo Auto decision of June 2025, the Garante recorded a rights request that was first caught by the company’s spam filter. In none of them had anyone decided to refuse. The message never reached a person.

A timeline. Tell people they’ll hear back within a month. The EDPB lists an acknowledgement with an estimated response time as a best practice, and an autoreply does it for you.

Does the US have a right to be forgotten?

Under that name, no, and there’s no federal law. What the US has is a set of state deletion rights. California’s CCPA gives residents a right to delete personal information a business collected from them. A business has to offer at least two ways to ask, and an email address is enough for one that operates only online. The response time is 45 calendar days, with one extension of 45 more.

The CCPA has thresholds. It applies to for-profit businesses that do business in California and have gross annual revenue over $25 million, or buy, sell or share the personal information of 100,000 or more California residents or households, or make half their revenue or more from selling it. Other states follow the same shape. Virginia’s law gives consumers a right to delete personal data provided by or obtained about the consumer, a 45-day response period, and a process to appeal a refusal.

Exceptions exist here too: completing a transaction the person asked for, legal obligations and legal claims, certain security uses. The grounds are listed differently from Article 17, but the practical steps match, so one procedure can serve both.

A five-minute check for your own site

Use a phone, logged out, as a stranger would.

1. Open your privacy notice. Search the page for “delete” or “erase”. If neither word appears, visitors can’t find the right.
2. Look for the how. Is there an email address, a form or a page named next to the right? Without one, the right is a sentence on a page and nothing more.
3. Tap the link. Does the email address open a mail app, and is it spelled right? Does the form page load?
4. Send a test. Use an address that has never written to you, with a long subject and no previous thread. Check it arrives, and not in junk.
5. Look for a timeline. Does the page say when a person will hear back? If not, add one line.
6. Check the wording. Does the notice name erasure alongside access, and say which regulator people can complain to? The EDPB’s report notes that people are not systematically informed about the existence of this right, even though Article 13 asks for it.

Peeky reads the public pages of your site. For the right to be forgotten and the route to ask, the checks are EU-07 and UK-09 in the Handbook, and US-11 for the state laws that give deletion rights and opt-outs in the US. For the access side of the same request, start with what a DSAR is, and for what counts as personal data in the first place, personal data examples.

Questions people ask

What is the right to be forgotten in simple terms?

A person can ask you to delete the personal data you hold about them, and in a set list of situations you have to. The law calls it the right to erasure, in GDPR Article 17, and the UK GDPR has the same article. It has grounds and it has exceptions, so it isn't a right to vanish from every record.

How long do I have to delete someone's data?

One month from the day the request arrives, under Article 12(3). You can extend by two further months for a complex or repeated request, but only if you tell the person within the first month. The ICO's guidance says the clock starts on receipt, or later if you need to confirm identity.

Can I refuse a request to be forgotten?

Sometimes. Article 17(3) lets you keep data that's needed for a legal obligation, legal claims, freedom of expression, a public interest task or research. The exception covers the data it applies to, not the whole record. If you refuse, tell the person within a month, give the reason, and say they can complain to the regulator.

Do I have to delete backups too?

Yes, as far as you can. The ICO says the key issue is to put backup data beyond use, even if it can't be overwritten at once, and to tell the person what will happen to it. A line in your reply covers that.

Does the US have a right to be forgotten?

Not under that name and not nationally. California's CCPA gives residents a right to delete personal information a business collected from them, with a 45-day response time, and it applies only to businesses above its thresholds. Virginia and other states have similar deletion rights.