Right to be forgotten (right to erasure)

Data subjects have the right to request that their personal data be removed from all the systems of the University if certain requirements are met. These requirements are:

• The University does not need to keep the data anymore in relation to the purpose for which they were originally collected/processed.
• The data subject withdraws consent for the processing to which they previously agreed
• The subject uses their right to object to the data processing (possible where the legal basis is either ‘public task’ or ‘legitimate interest’).
• The University is processing the data unlawfully (i.e. in breach of the GDPR and/or the DPA)
• The personal data must be erased in order to comply with a legal obligation.
• The data subject was a child at the time of collection.

This means that if the legal basis for processing the data is ‘performance of a contract’ or ‘legal obligation’, and processing is fully lawful, the request must be refused. Also, if the data is used for research, the researcher can exclude the right to erasure under the research exemption. 

If you receive a request for erasure, please get in touch with the DPO at

dpo@ed.ac.uk