Skip to content 
Recht auf Löschung (Art. 17 DSGVO)
A former customer demands that their data be erased. The records in the CRM are quickly removed. But what about backups, old notebooks in storage or the server that was dismantled last week? The right to erasure reaches further than many think.
In brief
The right to erasure under Art. 17 GDPR, also called the "right to be forgotten", obliges controllers to erase personal data without undue delay, on request or on their own initiative, when a statutory ground for erasure exists. Typical grounds are a purpose that no longer applies or a withdrawal of consent. For IT asset disposition, this means: even on decommissioned data carriers, no data may remain that should long since have been erased.
What does Art. 17 GDPR say?
Art. 17 para. 1 GDPR names six grounds for erasure. If one of them applies, the controller must erase the data, even without a request.
| Ground for erasure (Art. 17 para. 1) | Example |
|---|---|
| a) Purpose no longer applies | Application procedure is completed, the period for claims has expired |
| b) Consent withdrawn | Newsletter unsubscription without another legal basis |
| c) Justified objection | Objection to direct marketing |
| d) Unlawful processing | Data was collected without a legal basis |
| e) Legal obligation to erase | A law prescribes erasure |
| f) Data of children from online services | Consent of a child to an online offer |
If the controller has made the data public, it must additionally take reasonable steps under para. 2 to inform other controllers of the erasure request. Upon a request, it must as a rule respond within one month under Art. 12 para. 3 GDPR.
When does the right not apply?
Art. 17 para. 3 GDPR provides exceptions. The most important for companies is a statutory retention obligation, for example for accounting records or business letters. Further exceptions concern freedom of expression, public health, archiving and research purposes and the enforcement of legal claims. As long as a Retention period is running, the data is not erased but blocked and only removed after the period expires.
What does this mean for retired IT?
Erasure within the meaning of the GDPR means: the data is removed in such a way that it can no longer be restored without disproportionate effort. A recycle bin or a quick format is not enough. This also affects decommissioned devices:
- Old hard drives often hold copies of data that has already been erased in the active systems.
- Through Data remanence , remnants remain readable in the file system even after deletion.
- Anyone who passes on old devices unerased continues to process data without a legal basis and violates the principle of Storage limitation.
One Erasure concept specifies when which data is erased and how this is done for devices at the end of their use.
Rule of thumb: An erasure request is only fully met when the data is also unreadable on copies, backups and decommissioned data carriers – unless a retention obligation stands in the way.
Right to erasure at Second IT
For decommissioned hardware, Second IT takes over the physical part of the erasure. Every device is erased with Blancco, including hidden areas such as HPA and DCO, and receives a digitally signed erasure certificate with serial number. This documents that no data remains on decommissioned data carriers. More on the data security measures and in the article Data protection for hard drives. This entry does not replace legal advice.
Frequently asked questions about Art. 17 GDPR
What is the difference between the right to erasure and the right to be forgotten?
It is the same right. Art. 17 GDPR bears both names in its heading. "Being forgotten" emphasizes the obligation under para. 2 to also inform third parties about published data.
Does data also have to be erased from backups?
In principle yes, as soon as a ground for erasure exists. In practice, backups are often overwritten in fixed cycles. What matters is that erased data does not return from a backup to active operation and that old backup media are securely erased or destroyed at the end.
How quickly must I respond to an erasure request?
Without undue delay, at the latest within one month of receipt. In complex cases, an extension by two further months is possible. The data subject must then be informed within the first period.
When does the right to erasure under Art. 17 GDPR not apply?
Art. 17 para. 3 GDPR names exceptions. The most important is a statutory retention obligation. Others concern freedom of expression, public health, archiving and research purposes and legal claims. As long as a period is running, data is blocked and only erased afterward.
Does the right to erasure also apply to data on old hard drives?
Yes. Decommissioned data carriers often hold copies of data that has already been erased in the active systems. An erasure request is only fulfilled when copies, backups and old devices are no longer readable either, unless a retention obligation stands in the way.
Meet erasure obligations – even on decommissioned data carriers.
Send us your device list. You will receive your offer in 48 hours on average.