The right to erasure is a GDPR privacy right that lets a person ask an organization to delete personal data in defined circumstances, such as when the data is no longer needed, consent is withdrawn, or the processing is unlawful. It is often called the “right to be forgotten,” but in practice it is narrower because legal exceptions can require retention.
In cyber security, this right matters because deletion workflows handle sensitive identity data, support documents, and legal decisions. Defenders must build controlled request systems with authentication, access control, logging, retention rules, and secure deletion so that data is removed from primary systems and backups according to policy. Attackers may try to abuse erasure requests to hide evidence, delete records, or trigger data loss, so organizations need review, verification, and an audit trail to prove what was removed and why.