GDPR Article 17 — Right to Erasure

Article 17 of the GDPR grants every data subject the right to erasure of personal data. This is commonly referred to as the right to be forgotten. If the personal data is no longer necessary for the purposes for which it was collected, if the data subject withdraws consent, or if the processing was unlawful, the controller must erase the data without undue delay.

The right to erasure does not apply without restriction. Exceptions exist, for example, for the exercise of the right to freedom of expression, for the fulfillment of legal obligations, for reasons of public interest, or for the establishment, exercise, or defense of legal claims. In practice, organizations must therefore carefully examine whether an erasure claim exists.

PDF redaction can be an instrument for partially implementing Article 17 — namely when personal data must be removed from documents that themselves must be retained for legal reasons (e.g., invoices, contracts). For every redaction, Datenmaske generates a log that traceably documents the erasure of the data, thereby supporting compliance with Article 17.