GDPR Right to Erasure: What It Means

The right to erasure - Article 17 of the GDPR - is one of the most misunderstood parts of European privacy law. Businesses assume it lets them delete any unwanted review. Consumers assume it lets them wipe any digital trace. Neither is quite right. Here is what the right to erasure actually means in 2026, particularly in the context of online reviews.

What Article 17 Actually Says

Article 17 gives individuals the right to have their personal data erased in specific situations - when the data is no longer necessary for the purpose it was collected, when consent is withdrawn and there is no other legal basis, when the data was unlawfully processed, or when the person objects and the controller has no overriding legitimate ground to keep processing it.

It is not an unconditional right to be forgotten. It is a right that applies when specific legal grounds exist and no exemption overrides it.

The Freedom of Expression Exemption Matters

Article 17(3)(a) carves out an exemption for processing "necessary for exercising the right of freedom of expression and information." Reviews sit squarely in this exemption in most cases. A reviewer sharing an honest opinion about a business is exercising expression, and platforms hosting that review can rely on the exemption to refuse an erasure request from the business or, in many cases, from the reviewer themselves after publication.

This is why the right to erasure is not a magic delete button for reviews. Platforms weigh the request against the public interest in the information staying available.

Who Can Actually Request Erasure of a Review

The reviewer can request erasure of their own review data - their name, account details, and any personal information within the review text. That is straightforward, and platforms usually comply, though they may retain an anonymised version of the review itself.

The subject of the review - the business - has much narrower ground. A business cannot use Article 17 to force removal of a review simply because it is negative or embarrassing. The business is not the data subject; the reviewer is. Where a review contains personal data about employees (named staff members, for example), those individuals may have a case, but the business itself does not.

The Right to Object Is Often the Better Tool

Article 21 - the right to object - is often more relevant for reviews than Article 17. If a review contains personal data about a named individual and the individual objects, the platform must consider whether there are compelling legitimate grounds to continue processing that override the individual's interests.

For a named staff member accused unfairly in a review, an Article 21 objection is usually a stronger route than an Article 17 erasure request. The remedy might be anonymisation of the name rather than deletion of the whole review.

What a Valid Request Looks Like

A workable erasure request identifies the data subject, specifies the exact content at issue, states the ground under Article 17 the request relies on, and provides any supporting context. Vague requests get refused. Requests that cite the wrong legal ground get refused. Requests that ignore obvious exemptions get refused.

Platforms have one month to respond, extendable by two more months for complex requests. A refusal must explain the reasoning and inform the requester of their right to complain to a supervisory authority.

Businesses Handling Reviewer Data

If your business collects customer feedback and stores personal data - names, emails, service details - you are the data controller for that data. Reviewers can request erasure of their information from your systems even if the review itself is hosted publicly on a third-party platform.

Practical implication: keep a documented process for handling erasure requests, respond within the one-month window, and be able to explain what data you erased and what you retained (with legal basis) if the requester challenges the outcome.

The Legitimate Interest Angle

Many businesses process review data under "legitimate interest" - the sixth lawful basis in Article 6. When a data subject objects, the burden shifts to the controller to show the legitimate interest overrides the individual's rights. For raw contact details, that argument is weak. For anonymised, aggregated review analytics, it is usually strong. Know which category your processing sits in before responding to a request.

What Happens When You Get It Wrong

Ignoring a valid erasure request can result in a supervisory authority complaint, an order to comply, and a fine. Under GDPR, fines can reach 20 million euros or 4 percent of global annual turnover, whichever is higher. Real enforcement for review-related erasure failures tends to sit at the lower end of the scale, but the reputational cost of a public complaint often outweighs the fine itself.

Over-erasing is also a mistake. Deleting a review because of an invalid request can expose the business to a defamation-adjacent claim from the reviewer whose speech was suppressed.

The UK After Brexit

The UK GDPR mirrors Article 17 almost word for word, enforced by the Information Commissioner's Office. UK businesses handle erasure requests the same way EU businesses do, with the ICO as the supervisory authority. Cross-border businesses need to track both regimes because the enforcement patterns and case law differ in the fine detail.

The Short Version

The right to erasure is real, useful, and narrower than most people think. It protects data subjects, not businesses. It is balanced against freedom of expression, which usually protects honest reviews. If you receive a request, treat it seriously, respond within a month, and document the reasoning either way. Do not use it as a shortcut to delete criticism, and do not ignore it because you think it does not apply.

Frequently Asked Questions

Can a business use GDPR to remove a negative review?

No, a business generally cannot use the GDPR Right to Erasure (Article 17) to demand the removal of a negative review. The business is not the data subject in this context; the reviewer is. Reviews are often protected by freedom of expression, which is an exemption to the right of erasure. Businesses cannot remove reviews simply because they are unfavourable.

Does the Right to Erasure apply to all personal data?

The Right to Erasure applies to personal data only under specific circumstances, as outlined in Article 17 of the GDPR. These include when data is no longer necessary for its original purpose, when consent is withdrawn, or when data is unlawfully processed. It is not an absolute right to have all personal data deleted indiscriminately.

What is the difference between the Right to Erasure and the Right to Object?

The Right to Erasure (Article 17) allows for data deletion under specific legal grounds. The Right to Object (Article 21) allows individuals to object to data processing when there are personal reasons. For online reviews, the Right to Object often proves more relevant if personal data about an individual is being processed, potentially leading to anonymisation rather than full deletion.

What if a review mentions a specific employee by name?

If a review mentions a specific employee by name, that employee (as the data subject) may have grounds to request erasure or object to the processing of their personal data under GDPR. The business itself still cannot demand erasure on behalf of the employee. Platforms would then assess the request against freedom of expression and other legal bases.

How long do platforms have to respond to an erasure request?

Platforms generally have one month to respond to a valid erasure request under GDPR. This period can be extended by two additional months if the request is particularly complex. If a platform refuses the request, they must provide a clear explanation for their decision and inform the requester of their right to complain to a supervisory authority.