# R7 | openai/gpt-5.4-mini | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR’s **right to erasure** lets a person ask a controller to delete their personal data *without undue delay* when one of the Article 17 grounds applies. It is often called the “right to be forgotten,” but it is not an absolute right and it only applies in specific situations. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1673360464141&uri=CELEX%3A32016R0679&utm_source=openai))

## What it is

Under Article 17 GDPR, a controller must erase personal data when, for example, the data are no longer needed for the purpose collected, consent is withdrawn and there is no other lawful basis, the person successfully objects to processing, the data were unlawfully processed, or erasure is needed to comply with EU or Member State law. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1673360464141&uri=CELEX%3A32016R0679&utm_source=openai))

The EDPB describes it as one of the GDPR’s core data subject rights and notes that organisations must have processes to handle requests promptly. ([edpb.europa.eu](https://www.edpb.europa.eu/topics/key-gdpr-concepts/data-subject-rights_en?utm_source=openai))

## Main limitations

- **Not absolute:** A request can be refused where the GDPR’s exceptions apply. The EDPB explicitly says the right to erasure is not absolute. ([edpb.europa.eu](https://www.edpb.europa.eu/news/edpb-identifies-challenges-hindering-the-full-implementation-of-the-right-to-erasure_en?utm_source=openai))
- **Public interest, legal duty, and official authority:** Erasure is not required where processing is necessary for compliance with a legal obligation, for a task carried out in the public interest, or in the exercise of official authority. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1673360464141&uri=CELEX%3A32016R0679&utm_source=openai))
- **Freedom of expression and information:** The GDPR preserves the balance with other fundamental rights, so erasure can be limited where those rights prevail. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1673360464141&uri=CELEX%3A32016R0679&utm_source=openai))
- **Legal claims and defence:** Data may be kept if needed for the establishment, exercise, or defence of legal claims. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1673360464141&uri=CELEX%3A32016R0679&utm_source=openai))
- **Archiving, research, and statistics:** The GDPR allows retention where erasure would seriously impair archiving in the public interest, scientific or historical research, or statistical purposes, subject to safeguards. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1673360464141&uri=CELEX%3A32016R0679&utm_source=openai))
- **“Made public” data still has practical limits:** If a controller has made the data public, it must take reasonable steps to inform other controllers who are processing it, but that obligation is limited to what is reasonable. ([edpb.europa.eu](https://www.edpb.europa.eu/sme/be-compliant/respect-individuals-rights_ga?utm_source=openai))

## Practical takeaway

In practice, the right to erasure is a **qualified deletion right**: people can ask for deletion, but controllers must weigh the request against GDPR exceptions and other rights, including legal retention duties. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1673360464141&uri=CELEX%3A32016R0679&utm_source=openai))

If you want, I can also give you a **plain-English checklist for when an erasure request should be granted or refused**.
