Rights

Clicking delete produces a confirmation and a feeling of finality. Neither is the same as the data being gone. Deletion is a **request**, and what happens next is governed by rules most people have never read.

The right to erasure, and its five exceptions

**The right to erasure exists, and it is not absolute.** GDPR Article 17 gives you the right to have personal data erased. Article 17(3) then lists the situations where that right **does not apply** - and the list is short enough to know by heart.

Erasure does not apply where processing is necessary *"for exercising the right of freedom of expression and information"*; *"for compliance with a legal obligation"* or a task in the public interest; for public health reasons; *"for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes"*; or *"for the establishment, exercise or defence of legal claims"*.

Read the second and the fifth again, because they cover most of what you will actually encounter. A company that must keep invoices for tax purposes is under a legal obligation, and your erasure request does not override it. A company in a dispute with you can retain what it needs to defend itself.

**This is why a deletion confirmation and an empty profile can coexist with retained records.** The account is gone from the interface. The transaction history sits in a finance system under a retention schedule that has nothing to do with your account and everything to do with tax law.

Backups, and copies you cannot reach

**Backups are the second reason, and the least discussed.** A live database can honour a deletion quickly. A backup taken last month is a frozen copy, and selectively editing it would defeat its purpose - a backup you can rewrite is not a reliable backup. The common practice is to let backups age out on their own cycle, with the deleted record suppressed if a restore ever happens. That is a defensible engineering position, and it means the honest answer to "is it gone" is "from the systems that serve you, yes; from every copy in existence, not yet".

• GDPR Article 17 gives a right to erasure - Article 17(3) lists five exceptions
• Legal obligation and defence of legal claims cover most real retention
• Backups age out on their own cycle rather than being edited
• Data already shared or sold is outside the reach of your request
• Deletion stops new collection and removes you from the next breach

**Third-party copies are the part deletion never reaches.** If data was shared or sold before you deleted, your request goes to the company you asked, not to everyone it passed the data to. This is the gap that makes deletion and prevention different problems: you can close an account today, and the profile a broker built from it three years ago carries on.

What deletion does achieve

**So what does deleting actually achieve?** More than nothing, and it is worth doing. It removes the live profile from an interface where anyone with your password could reach it. It reduces what a future breach of that company can expose - a dormant account is a liability, and closing it removes you from the next incident. And it stops new collection: whatever the company would have gathered from tomorrow onwards, it no longer will.

The realistic framing is the one worth carrying: **deletion controls the future better than it edits the past.** Ask for erasure, expect the exceptions, and treat what you have already released as a separate problem needing separate work.