GDPR Article 17 — Right to Erasure (Right to Be Forgotten)

constraint.gdpr-right-to-erasure ↗

GDPR Article 17 requires data controllers to erase personal data without undue delay on six grounds: original purpose expired; consent withdrawn; Art. 21 objection upheld; unlawful processing; legal obligation; child data (Art. 8). Controllers who made data public must notify other processors of erasure requests using reasonable technical measures. For CDP architectures, erasure must cascade across CDW tables, rETL destination syncs, ad platform custom audiences, CRM records, and all downstream copies. Five exceptions: freedom of expression; legal compliance; public health; archiving/research/statistics; legal claims.