The right to be forgotten, also called the right to erasure, lets you ask a company to delete personal data it holds about you. It is written into GDPR Article 17 and is strongest in the EU and UK. It is not absolute, and for AI there is a catch: deleting a source record does not always remove that data's influence from a model already trained on it.
What is the Right to Be Forgotten?
The right to be forgotten is the right to ask an organisation to delete personal data it holds about you. In law it is usually called the right to erasure. You send a request, and if a legal ground applies, the organisation has to remove your data and, in some cases, tell others who received it to do the same.
The right is strongest in the European Union and the United Kingdom, where it sits inside the General Data Protection Regulation. Other regions vary. Some US state laws, such as California's privacy rules, give a deletion right, but there is no single federal equivalent, and many countries have narrower rules or none. The strength of your request depends on where you live and where the company operates.
- Right to be forgotten and right to erasure mean the same thing.
- It applies to personal data, meaning information that identifies you.
- Coverage is strongest in the EU and UK, weaker or absent elsewhere.
Where the law comes from: GDPR Article 17
The legal home of the right to be forgotten is Article 17 of the GDPR, titled the right to erasure. It lists specific grounds on which you can demand deletion. These include cases where the data is no longer necessary for the purpose it was collected for, where you withdraw the consent the processing relied on, where you object and no overriding legitimate ground remains, where the data was processed unlawfully, and where the data was collected from a child for an online service.
The idea reached the public through the 2014 Google Spain ruling, where the Court of Justice of the European Union decided a person could ask a search engine to remove links to old pages about them. GDPR later put a clearer statutory version of that principle into force.
- Article 17 lists the grounds that trigger a valid erasure request.
- Common triggers: data no longer needed, consent withdrawn, unlawful processing.
- Organisations must usually respond without undue delay, in principle within one month.
It is not an absolute right
A common misunderstanding is that you can force any company to erase anything about you. You cannot. GDPR Article 17 and the European Commission both make clear that the right to erasure is not absolute. It gives way when keeping the data serves a stronger public or legal interest.
Recognised exceptions include processing needed for freedom of expression and information, compliance with a legal obligation that requires the data to be kept, reasons of public interest in public health, archiving and scientific or historical research, and the establishment or defence of legal claims. A bank, for example, may be required by law to retain transaction records for years even if you ask it to delete them.
- Freedom of expression and journalism can override an erasure request.
- Legal retention duties, such as tax and financial records, take priority.
- Public health, research, archiving, and legal claims are further exceptions.
Delisting versus real deletion
It helps to separate two things that often get lumped together. Search delisting means a search engine stops showing a link when someone searches your name. The original page still exists on the web. The information has not been deleted, it has become harder to find through that one route.
Actual deletion means the organisation that holds your data removes it from its own systems. That is a stronger outcome, but its reach stops at that organisation's own copies. If your data was already copied, published, or shared elsewhere, one deletion request does not automatically reach every downstream copy.
- Delisting hides a result from search, it does not delete the underlying page.
- Deletion removes data from one organisation's own systems.
- Neither guarantees that every copy everywhere disappears.
The hard AI problem: training does not un-remember easily
AI adds a technical problem the original law did not anticipate. When a company trains a model on data that includes yours, your information is not stored as a neat row that can be found and struck out. It is spread across millions of numeric parameters that mix contributions from the entire training set. Deleting the source record from a database is straightforward, but that does not necessarily remove the data's influence from a model already trained on it.
The research area that tries to fix this is called machine unlearning, and surveys describe it as difficult and unsolved. Exact unlearning, meaning retraining the model from scratch without your data, is the only method with a strong guarantee, and it is often too expensive to run. Faster approximate methods try to edit the model to forget, but without a firm guarantee that every trace is gone. So an honest statement today is that deleting your source data helps, but it does not by itself prove a trained model has forgotten you.
- Trained models blend your data into shared parameters, not a deletable record.
- Machine unlearning is an active research problem, not a solved feature.
- Retraining from scratch guarantees erasure but is usually too costly to do routinely.
How MemX approaches your data
This is where a design choice matters more than a promise. MemX does not train its models on your data, and it keeps each user's memory in an isolated store rather than folding it into a shared model. Because your information is never baked into a model that many people share, deleting your data actually removes it, instead of leaving influence that unlearning research still struggles to strip out.
MemX describes this as private by architecture: per-user isolation, customer-managed encryption keys, encryption at rest, and on-device handling where possible. It is not end-to-end encryption and not a zero-knowledge system, so it is worth understanding what the design does and does not claim.
- MemX does not train on user data, so deletion is not undercut by a shared model.
- Each user's memory is isolated, which keeps a delete request effective.
- Private by architecture, not end-to-end encrypted or zero-knowledge.
Key takeaways
- The right to be forgotten is the right to erasure: asking an organisation to delete your personal data.
- Its legal basis is GDPR Article 17, and it is strongest in the EU and UK while other regions vary.
- It is not absolute: free expression, legal retention duties, research, and legal claims can override it.
- Delisting hides a result from search, actual deletion removes data from one organisation's systems, and neither reaches every copy.
- Once your data trains an AI model, deleting the source record does not reliably erase its influence, because machine unlearning is still limited.
- MemX does not train on user data and isolates each user's store, so deleting your data removes it rather than leaving traces in a shared model.
Frequently asked questions
Related terms
Related reading
Sources
Put the idea into practice
MemX is an AI memory agent built on these ideas: store anything, skip the folders, and find it again by asking in plain English.
Try MemX Free