Closing an account does not automatically mean your data disappears. Many services simply deactivate the profile and keep your name, email, purchase history and preferences for years. Article 17 of Regulation (EU) 2016/679 gives you the right to have personal data concerning you erased, but only under certain conditions. Knowing them lets you write a request that the controller cannot dismiss with a stock reply.
Grounds for erasure
The controller must erase the data without undue delay if at least one of these grounds applies.
- The data is no longer necessary for the purposes for which it was collected. Example: you entered a prize draw that ended long ago.
- You have withdrawn the consent on which the processing was based and there is no other legal basis. Example: a newsletter you had signed up for.
- You have objected to the processing under Article 21 and there are no overriding legitimate grounds, or you have objected to direct marketing.
- The data has been processed unlawfully, for instance collected without any legal basis.
- Erasure is required by a legal obligation to which the controller is subject.
- The data was collected when you were a minor in connection with information society services, such as social networks and apps, offered directly to children.
This last ground is especially useful for anyone who wants to remove content and profiles created as a teenager: the law recognises that at that age people were not fully aware of the risks.
The exceptions: when the controller can refuse
The right to erasure is not absolute. Paragraph 3 of Article 17 lists the cases in which the controller may keep the data despite your request:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation or the performance of a task carried out in the public interest;
- for reasons of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research or statistical purposes, where erasure would seriously impair those purposes;
- for the establishment, exercise or defence of legal claims.
The most common exception: tax obligations
In practice, the reason for refusal you will meet most often is the duty to retain accounting records. An online shop must keep invoices for the period required by tax and civil law. That does not, however, entitle it to keep everything else: it may retain the data needed for the invoices, but it must erase browsing preferences, wish lists, promotional sign-ups and profile data unrelated to accounting obligations.
A correct reply is therefore often a partial erasure: the controller deletes what is no longer needed and explains which data it keeps, under which obligation and until when.
How to write an effective request
A well-built request reduces the risk of evasive answers.
- Identify the account with the email address or customer number.
- State the ground from those listed in Article 17: for example, withdrawal of consent or the fact that you no longer use the service.
- Ask for written confirmation of the erasure and, for any data retained, the legal basis and retention period.
- Ask for Article 19 to be applied, meaning that the erasure is communicated to the recipients to whom the data was disclosed, and for a list of those recipients.
The deadline is the general one in Article 12: one month, extendable by two months in complex cases with a reasoned notice.
Data made public by the controller
If the controller has made your data public, for example by publishing it on its own website, Article 17(2) adds a further duty: taking account of available technology and the cost of implementation, it must take reasonable steps to inform other controllers processing that data that you have requested the erasure of any links, copies or replications.
Deactivate, anonymise, delete
Companies use different words that do not mean the same thing.
| Term | What happens to the data |
|---|---|
| Deactivation | The profile is not visible, but the data remains intact |
| Suspension | The service is temporarily blocked, the data remains |
| Anonymisation | The data can no longer be linked to you; if genuine, it falls outside the GDPR |
| Erasure | The data is removed from live systems |
If the reply says "we have deactivated your account", your erasure request has not been fulfilled. It is worth replying and explicitly asking for the data to be deleted.
What about backups?
Backup copies are normally overwritten on scheduled cycles. It is acceptable for data to survive in backups for a limited period, provided it is not restored and used. You can ask the controller to tell you how long that period is.
In short
- Article 17 GDPR requires erasure when data is no longer needed, when you withdraw consent, when you object or when processing is unlawful.
- Data collected through apps and social networks while you were a minor enjoys stronger protection.
- Exceptions such as tax obligations justify keeping only the strictly necessary data.
- "Deactivating" an account is not the same as erasing its data.
- Always ask for written confirmation and for the erasure to be passed on to recipients.