Right to deletion: when you can ask a business to erase your data

Section 44 of the Data Protection Act, 2024 gives a data subject the right to have their personal data erased, but it is not a general “delete me” button. It applies only where one of a specific set of grounds is met, and even then, a business can refuse where one of the Act’s own exceptions applies.

The grounds for erasure

Section 44(1) sets out when a controller is obliged to erase data:

The data subject shall have the right to obtain from the data controller the erasure of personal data concerning him or her without undue delay, and the data controller shall have the obligation to erase the personal data without undue delay where one of the following grounds applies. (s.44(1))

Those grounds are:

• The data is no longer necessary for the purpose it was originally collected or processed for.
• The data subject withdraws consent, and there is no other lawful basis left to justify the processing.
• The data subject objects to the processing, and there are no overriding legitimate grounds for it to continue.
• The data was processed unlawfully in the first place.
• Erasure is required to comply with a legal obligation the controller is subject to.

The exceptions that can block it

Even where one of those grounds applies, section 44(3) sets out situations where a controller does not have to erase the data:

Subsections (1) and (2) shall not apply where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation to which the data controller is subject, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims. (s.44(3))

So a request for erasure can be entirely valid on the grounds above and still be refused if, for example, the business needs to keep the record to defend a legal claim, or is required by another law to retain it. This is why deletion requests need to be assessed rather than automatically actioned: it depends on which ground applies, and whether an exception blocks it.

Erasure when the data has already been shared publicly

Where a controller has made personal data public and is then obliged to erase it, section 44(2) requires it to take reasonable steps, including technical measures, to tell other controllers who are processing that data, such as anyone who copied or linked to it, that erasure has been requested. It cannot force those other parties to delete their own copies, but it does have to make a genuine effort to let them know.

If deletion is not the right fit

Where full erasure is not available but the processing still needs to stop for now, right to restrict processing covers the middle ground: the data stays, but active use of it is paused.