Data Deletion Rights Around the World

Article 17 of the GDPR gives anyone in the EU the right to have their personal data deleted. This guide explains when the right applies, how to request it, and what companies are obliged to do.

The UK GDPR and the Data Protection Act 2018 give people in the UK a right to erasure that closely mirrors Article 17 of the EU regulation. Requests go to the same companies and follow the same one-month deadline.

California law gives residents the right to tell a business to delete the personal information it has collected about them. The CPRA expanded these rights and created the California Privacy Protection Agency to enforce them.

Brazil’s Lei Geral de Proteção de Dados (LGPD) gives people the right to request deletion of unnecessary or excessive personal data, unlawful data, and data processed on the basis of withdrawn consent.

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) gives individuals the right to withdraw consent and to access or challenge the accuracy of their personal information held by private-sector organisations.

India’s Digital Personal Data Protection Act, 2023 introduces a formal right to erasure: a Data Principal can ask a Data Fiduciary to delete personal data once the purpose of processing is served, unless retention is required by law.