Right to be Forgotten

The right to be forgotten is a person's right to demand that their personal data be fully erased from a system — real deletion, not merely hiding or deactivating.

The right to be forgotten is where privacy meets the most friction with data architecture, because many systems are built to keep history, not erase it. The core tension is with data immutability: if an event is meant to stay untouched, fully deleting one person's data needs a special path, not an ordinary overwrite. The common trap is conflating “deletion” with “deactivation”; hiding an account or cutting access to it is not forgetting, because the data still exists. Properly exercising this right needs two things: the ability to find all of a person's data everywhere in the system, and a clear process with a defined deadline for its real deletion. The legal point is that in the processor-controller relationship, the request usually comes through the controller and the processor deletes on their instruction.