GDPR Article 17 is the EU legal rule behind the “right to erasure,” sometimes called the right to be forgotten. It lets a person ask for personal data to be deleted when the legal grounds no longer apply, consent is withdrawn, or the data was collected unlawfully. The right is not absolute: controllers must also consider exceptions such as legal obligations, freedom of expression, public interest, and the need to defend legal claims.
In cyber security and privacy engineering, Article 17 matters because deletion is a controlled data-processing workflow, not a simple button. Platforms handling removal requests need strong identity checks, secure evidence upload, access controls, retention limits, logging, and audit trails. In real systems it appears in search de-indexing, account closure, and post-incident cleanup when exposed or unnecessary personal data must be removed. Attackers may try to abuse erasure channels to hide records or disrupt investigations, so defenders rely on verification and documented decisions, including reasoned refusals when deletion is not allowed.