# GDPR Right to Erasure Exceptions: When Refusal Is Lawful

GDPR right to erasure exceptions explained: each Article 17(3) ground, how national press law and search engines apply them, and how to word a request.

---


An erasure request under Article 17 of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) is lawfully refused when the organization can show that none of the six grounds in Article 17(1) applies, or that one of the five exceptions in Article 17(3) covers the processing. The exception that decides most online cases is freedom of expression and information.

A refusal is not always a violation. It is a decision with stated reasons, and those reasons tell you which argument to answer. This guide reads the regulation, the [European Data Protection Board guidance on search engines](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-52019-criteria-right-be-forgotten-search-engines_en) and the 2014 Court of Justice judgment that created de-listing, then turns them into plain rules: what each exception means, where it stops, and how to word a request so a refusal is less likely.

This is information, not legal advice. A lawyer in the country that applies to your case decides what is right for you.

<div class="box"><b>The short version</b>
<ul><li>Article 17(3) lists five exceptions: freedom of expression and information, a legal obligation or public task, public health, archiving and research, and legal claims.</li><li>Freedom of expression is the one that matters online, and national law under Article 85 decides how far journalism is shielded.</li><li>A search engine is judged differently from the publisher of the page: the balance can tip toward de-listing a result while the article stays online.</li><li>Requests succeed more often when they name the exact page, the name searched, the ground relied on and the personal harm, and when they ask for less than everything.</li><li>A refusal must come with reasons and a route to a regulator and a court, normally within one month.</li></ul></div>

## A refusal is lawful when no ground applies or an exception does

The right to erasure is not a right to delete anything about yourself on demand. Article 17(1) gives a right to have personal data deleted without undue delay when one of six grounds applies: the data is no longer needed for its original purpose, you withdraw consent and nothing else supports the processing, you object under Article 21(1) and there are no overriding legitimate grounds, the data was processed unlawfully, erasure is required by a legal obligation, or the data was collected from a child for online services.

Article 17(3) then says those rights do not apply where processing is necessary for five purposes. The table gives the plain meaning of each.

<div class="tablewrap"><table><thead><tr><th>Exception</th><th>Plain meaning</th><th>Most often cited by</th></tr></thead><tbody>
<tr><td><strong>17(3)(a) Expression and information</strong></td><td>The data is needed to exercise free speech or the public's right to information</td><td>Publishers, archives, platforms</td></tr>
<tr><td><strong>17(3)(b) Legal duty or public task</strong></td><td>A law requires the data to be kept, or a public body needs it for its task</td><td>Employers, banks, registers, agencies</td></tr>
<tr><td><strong>17(3)(c) Public health</strong></td><td>Health-sector processing under the special rules of Article 9</td><td>Health bodies</td></tr>
<tr><td><strong>17(3)(d) Archiving and research</strong></td><td>Deletion would make the archive, study or statistics impossible or seriously harm them</td><td>Archives, universities</td></tr>
<tr><td><strong>17(3)(e) Legal claims</strong></td><td>The data is needed to bring, pursue or defend a claim</td><td>Any party in a dispute</td></tr>
</tbody></table></div>

Two other routes to a refusal sit outside Article 17(3). Under Article 12(5) the controller may refuse a manifestly unfounded or excessive request, and it carries the burden of showing that. Controllers also commonly answer that they cannot identify you or are not the controller of the page. Those are procedural answers, usually fixable with a better request.

The [Information Commissioner's Office guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/) on the right to erasure under the UK GDPR lists comparable exemptions: five general ones and two for special category data. This guide follows the EU text, and the UK rules are a separate regime.

<figure class="keyfacts">
<div class="keyfacts-grid">
<div><b>Five</b><span>exceptions in Article 17(3)</span></div>
<div><b>One month</b><span>to answer, from receipt of the request</span></div>
<div><b>Two months</b><span>of extension at most, notified within the first month</span></div>
</div>
<p class="fig-src">Article 17(3) and Article 12(3) of Regulation (EU) 2016/679, as read in the consolidated text published on EUR-Lex.</p>
</figure>

## Freedom of expression and information is the exception that decides most online cases

Article 17(3)(a) removes the right to erasure where processing is necessary for exercising freedom of expression and information. Newspapers, bloggers, forum hosts and archives reach for it first, and it is not an automatic win. The EDPB guidelines on search engines say the exception calls for a balance between the rights to privacy and data protection in Articles 7 and 8 of the EU Charter and the right to freedom of information in Article 11.

The exception is weighed on facts. These move the balance:

- **Role in public life.** The EDPB criteria and Google's published factors both start here: a person with a public role tends to have less room than a private person.
- **Professional link and accuracy.** The EDPB criteria separate information tied to professional life from information that only affects privacy, and treat data that looks like verified fact but is inaccurate as supporting a request.
- **Age.** Google's help page lists the age of the content and later developments as factors, so a story's weight can change over time.
- **Nature of the data.** For special categories such as health data, the guidelines say a search engine must ask whether keeping the link is strictly necessary to protect users' freedom of information.

"Lawful and true" is an argument for the controller, not the end of the analysis: the Court of Justice accepted that lawful content can be de-listed from name searches.

## National law decides how far journalism is shielded

Recital 153 of the GDPR says Member State law should reconcile freedom of expression and information, including journalistic expression, with data protection. It says processing solely for journalistic purposes should be subject to derogations or exemptions where needed, that the notion of journalism should be read broadly, and that where national exemptions differ, the law of the Member State where the controller is established applies. The EDPB guidelines point to Article 85(2) of the GDPR as the basis on which Member States can give web publishers a journalism exemption.

So whether a newspaper can refuse depends on the country. The regulation leaves the balance to national law, so the same article in two countries can meet two different legal tests. This guide did not read any national provision, so it states none.

Two practical points follow:

- **Find the national provision.** A request to a publisher should cite the Article 17 ground and expect the publisher to answer with its own country's journalism provision. Reading that provision, or having counsel read it, shows whether the refusal rests on a valid exemption.
- **Expect a broad reading of journalism.** Recital 153 asks for the notion to be read broadly, so do not assume a small or independent outlet falls outside it.

The EDPB guidelines also describe a distinction the European Court of Human Rights drew in M.L. and W.W. v Germany (judgment of 28 June 2018). A request against the original publisher touches the heart of what free expression protects. A request against a search engine concerns mainly its role in making information about a person easy to find and to profile. The two requests can therefore end differently on the same facts.

## A legal obligation or public task covers records the law makes the organization keep

Article 17(3)(b) lets an organization refuse where processing is necessary to comply with a legal obligation under EU or Member State law, or to perform a task in the public interest or exercise official authority. In ordinary life this is the exception behind tax and accounting retention, employment records, anti-money-laundering checks and official registers.

It has clear limits. The text requires a legal obligation that requires the processing under EU or Member State law, so a company policy or a habit of keeping everything does not qualify, and the exception generally ends when the legal period does. Ask the controller which law it relies on and for how long.

For search engines the EDPB guidelines describe this exception as difficult to apply. A legal duty to publish binds the web publisher, and the guidelines say the search engine cannot invoke it, though the duty still counts in the balance because it indicates a public interest in access.

## Public health, archiving and research are narrow and need proof of harm

Article 17(3)(c) covers public health processing under Article 9(2)(h) and (i) and Article 9(3). It is a health-sector exception, and the EDPB guidelines say it is difficult to imagine that keeping name-search results is necessary for public health reasons.

Article 17(3)(d) covers archiving in the public interest, scientific or historical research and statistical purposes under Article 89(1), but only where erasure is likely to make those objectives impossible or seriously impair them. The controller must show that deleting your data would damage the research or archive, not just inconvenience it. The EDPB guidelines say a search engine must show that de-listing is a serious obstacle to the purpose or prevents it completely. In our experience a national archive holding a historical record tends to have the stronger case, while a site that calls its back catalog an archive would have to show a genuine archiving or research purpose.

## Legal claims let a controller keep what a dispute needs

Article 17(3)(e) covers processing necessary for establishing, exercising or defending legal claims. It is the exception behind a refusal from a company you are in a dispute with, or from a party that expects to be sued. It protects evidence, and the wording "to the extent that processing is necessary" ties it to the claim: the controller may keep what the claim needs, not everything it holds about you.

For a search engine the EDPB guidelines say it is very unlikely that this exception can be used. De-listing removes a result from name searches and leaves the page online.

A practical test for a refusal is three questions. Is there an actual or reasonably expected claim? Is the specific data relevant to it? Can retention be limited to that data, with restricted access? Keeping a whole profile for a dispute about one invoice is weak.

## Search engines weigh public interest in de-listing differently from publishers

The Court of Justice of the European Union created de-listing in [Google Spain v AEPD and Costeja González](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62012CJ0131), case C-131/12, decided on 13 May 2014. It held that a search engine operator is a controller of the processing it carries out when it finds, indexes and ranks third-party pages. It also held that the operator may be obliged to remove from the results of a name search links to pages published by others, even where the publication on those pages is lawful and the page itself is not deleted.

The Court set the default and its exception in plain terms. In paragraph 97, the data subject's rights override, as a rule, the economic interest of the operator and the interest of the public in finding the information through a name search. The exception is a preponderant interest of the general public in having access, which can arise from particular reasons such as the role the person plays in public life. In paragraph 85 the Court noted that a publisher may act solely for journalistic purposes, which does not appear to be so for the operator, so the rights can in some circumstances be exercised against the operator but not the publisher.

For objection requests under Article 17(1)(c), the EDPB guidelines put the burden on the search engine: it must demonstrate compelling legitimate grounds for keeping the result, or delist. The guidelines give examples of circumstances that support a request, including that the person plays no role in public life, that the information is not related to professional life but affects privacy, that it constitutes hate speech, slander, libel or similar offences, that it looks like verified fact but is inaccurate, and that it relates to a relatively minor criminal offence from a long time ago. The guidelines also say the data subject's particular situation is what the request rests on and is weighed against the public's right to information.

[Google's help page](https://support.google.com/legal/answer/10769224) for removal under European privacy law shows how one operator applies this. Its factors include your public role, the source, the age of the content and later events, the legitimate interest of people searching your name, whether the claim is true, and sensitivity, and it says none is decisive. It adds that delisting applies to searches for your name and that the content may still appear for other queries. Read the page again before filing, because operator policies change.

<aside class="callout">
<span class="callout-label">Limit</span>
<h4>De-listing changes name searches, not the page</h4>
<p>A successful request removes a result for searches on your name. The page stays online and can still appear for other queries. Removing the page itself is a separate request to its publisher, judged under the publisher's own exceptions.</p>
</aside>

## Which exception to expect depends on who you ask

The same fact pattern is judged differently depending on the recipient. The table shows the exception a refusal most likely rests on, how strong it tends to be and the best response. It is a guide, not a prediction.

<div class="tablewrap"><table><thead><tr><th>You ask</th><th>Likely exception</th><th>How it tends to hold</th><th>Best response</th></tr></thead><tbody>
<tr><td><strong>News publisher</strong></td><td>17(3)(a) with national journalism rules</td><td>Strong for recent, accurate, public-interest reporting</td><td>Ask for correction, update or anonymization, not deletion</td></tr>
<tr><td><strong>Search engine</strong></td><td>17(3)(a) as public interest in access</td><td>Weaker than for the publisher; turns on role and age</td><td>Object, name the query, give your particular situation</td></tr>
<tr><td><strong>Former employer or business</strong></td><td>17(3)(b) retention duty</td><td>Strong while the legal period runs, then fades</td><td>Ask which law, which period, and for restricted access</td></tr>
<tr><td><strong>Public register or archive</strong></td><td>17(3)(b) or (d)</td><td>Strong where a law requires publication</td><td>Use the register's own correction or suppression rules</td></tr>
<tr><td><strong>Opposing party in a dispute</strong></td><td>17(3)(e) legal claims</td><td>Limited to the data the claim needs</td><td>Ask for scope limits and a review date</td></tr>
</tbody></table></div>

Against a publisher, erasure tends to be the weakest tool. Correction, updating or a right of reply ask for less and are usually harder to refuse.

## Word the request so the refusal has less to stand on

A request is refused more easily when it is vague, broad or silent on the legal ground. The aim is to answer the likely exceptions in advance without writing a legal brief. This is about wording the argument, not a template to copy.

<figure class="fig">
<figcaption><b>Wording a request that is harder to refuse</b></figcaption>
<ol class="fig-steps">
<li><b>Identify yourself and the page</b>Give the exact URL, the name or query it appears under and enough detail for the controller to confirm you are the person concerned. Requests that stall on identity can add delay.</li>
<li><b>State the ground in Article 17(1)</b>Say which ground applies: no longer necessary, withdrawn consent, objection under Article 21(1), or unlawful processing. For a search engine, objection tends to be the broadest ground.</li>
<li><b>Give your particular situation</b>Explain the concrete harm: a hiring decision, a professional licence, a family risk. The EDPB guidelines treat the person's own situation as part of the balance.</li>
<li><b>Address the likely exception</b>If the page is journalism, say why public interest has faded: age, minor role, outcome, correction. Do not assert that press content is exempt from deletion rules in general, because that depends on national law.</li>
<li><b>Ask for the narrowest remedy</b>Ask first for what is easiest to grant: de-listing from name searches, anonymization, restricted access or an update. Keep full deletion for data with no remaining purpose.</li>
<li><b>Ask for reasons in writing</b>Ask which exception is relied on and, for a legal obligation, which law and period. A refusal that names neither is easier to challenge.</li>
</ol>
</figure>

Three habits tend to make refusals more likely: demanding deletion of a whole news archive, which invites the expression exception; sending repeated identical or aggressive requests, since Article 12(5) names a repetitive character as a reason to treat a request as excessive; and claiming falsehood without evidence, which Google's help page says it is not well placed to judge.

**A worked scenario.** Take an invented case: a consultant is named in a regional news report about a licensing dispute that a regulator closed with no finding against her, and it ranks first for her name. Deleting the article tends to meet the expression exception and the publisher's national press rule. An objection to the search engine, relying on the closed outcome and the harm to client work, tends to be stronger. A request to the publisher for an update showing the outcome is the easiest to grant. Three requests, three exceptions, three sets of odds.

## A refusal has a timeline and a next stage

Article 12 sets the clock. The controller must act within one month of receipt, may extend by two months for complex or numerous requests if it tells you why within the first month, and must give reasons for any refusal together with your right to complain to a supervisory authority and to seek a judicial remedy.

<div class="tablewrap"><table><thead><tr><th>Stage</th><th>What the controller owes</th><th>Your move</th></tr></thead><tbody>
<tr><td><strong>Day 0 to month 1</strong></td><td>An answer, an extension notice or a refusal with reasons</td><td>Keep the sent request and proof of delivery</td></tr>
<tr><td><strong>Month 1 to month 3</strong></td><td>Only if it notified an extension in month one</td><td>Check the extension notice has reasons</td></tr>
<tr><td><strong>After a refusal</strong></td><td>A named exception and the complaint and court routes</td><td>Reply to the stated exception, then complain to the authority</td></tr>
</tbody></table></div>

In our experience some files run past these periods. Check which supervisory authority handles complaints for your country before filing.

If the refusal stands and the page stays public, suppression is the lawful alternative for accurate content: building better, truthful pages so that the result you cannot remove loses its place. Our page on [suppressing negative results](/suppress-negative-results) explains how that works. Resending the same request again and again is the pattern Article 12(5) describes as repetitive.

## The next step is to match the exception to the route

Read the refusal for the exact exception. If it cites a ground you can answer on the facts, answer it once, in writing, with evidence. If not, switch to correction, de-listing or suppression.

<div class="box hot"><b>If this is happening to you now</b>
<p>Reputation Partners can read a refusal with you, identify which exception it relies on and which route is still open for your content. Start with a private look at the case through our <a href="/audit">audit</a>.</p></div>

## Questions people ask

### Can a company refuse to delete my data just because it is true?

No. Accuracy is one factor, not an exception. An organization can refuse only if an exception such as a legal retention duty or the expression right applies, or the request is manifestly unfounded or excessive. Accurate data that has no remaining purpose can still be deleted under the grounds in Article 17(1), and lawful content can be de-listed from name searches.

### Can a controller refuse only part of a request?

Yes. The ICO's guidance says a controller can refuse wholly or partly when an exemption applies. A common outcome is that the page stays, a name is removed, or access is restricted. Asking for the narrowest remedy first makes a partial yes more likely than a full no.

### What if the controller does not answer at all?

Silence breaches the time limit in Article 12, which requires an answer, a reasoned extension notice or a reasoned refusal within one month. Keep proof that you sent the request, send a short written reminder, and then consider a complaint to the supervisory authority that has competence for the controller.

### Do the same exceptions apply in the UK?

The UK GDPR is a separate regime from the EU text. The Information Commissioner's Office guidance lists five general exemptions to erasure and two for special category data, and says a controller can refuse wholly or partly when one applies. This guide did not read UK rules on journalism, so check the ICO's guidance before relying on this summary.