Right to Erasure (Article 17 GDPR)

Also the 'right to be forgotten' — limited by retention obligations

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

The right to erasure under Art. 17 GDPR (also the 'right to be forgotten') grants data subjects the right to obtain the erasure of their data without undue delay. It applies where: the processing is no longer necessary, consent has been withdrawn, an objection has been raised without overriding grounds, or the processing is unlawful. It is limited by retention obligations (German Commercial Code (HGB), German Fiscal Code (AO), German Social Code (SGB)).

Art. 17(1) lists 6 grounds for erasure. Art. 17(3) sets out exceptions: statutory retention obligations, legal defence, public interest, research.

Conflict in practice: the HGB and the AO require retention for 10 years — to that extent, the erasure claim is not enforceable. Solution: restriction instead of erasure, followed by erasure once the retention period has expired.

Retention obligations: Germany and Austria

As an EU regulation, Art. 17 GDPR applies equally in Germany and Austria. However, the limitation on erasure under Art. 17(3) GDPR is tied to national retention law — and this differs between the two countries. Anyone processing data in Austria may not rely on the German 10-year periods (HGB, AO).

Germany

Commercial books, inventories, accounting vouchers: 10 years (§ 257 HGB)
Tax-relevant records: 10 years (§ 147 AO)
Social data: separate retention and erasure rules under the SGB

Austria

Business books, vouchers and records: 7 years (§ 212(1) UGB)
Books, records and vouchers relating to taxes: 7 years (§ 132(1) BAO)
Social insurance data: retention rules under the ASVG

The following applies in both countries: for as long as a statutory retention obligation is running, the erasure claim is not enforceable to that extent. The data concerned is blocked (restriction of processing) and erased only after the relevant period — 10 years in Germany, 7 years in Austria — has expired.

Practical example

Example: a customer requests the erasure of their order history. The Controller checks:

Active business relationship? No → no legitimate interest
Accounting retention? 10 years → restriction instead of erasure
Marketing newsletter? Immediate erasure possible

Frequently asked questions

Do I have to approach third-party providers?

For data that has been made public: yes (Art. 17(2)) — reasonable measures to inform recipients of the erasure request.

What about backups?

Backup data is also subject to the erasure claim — erase it at the next backup cycle or block it in a documented manner.

The customer asks for 'erasure' — but is restriction actually an option?

Restriction can replace erasure where erasure is not legally possible (retention obligation). Inform the customer clearly.