# R7 | anthropic/claude-haiku-4.5 | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR right to erasure, also known as the "right to be forgotten," is a legal entitlement that allows individuals to request deletion of their personal data from organizations. However, this right is not absolute and applies only under specific circumstances, with significant exceptions.

## What is the Right to Erasure?

Under Article 17 of the UK GDPR, individuals have the right to request that controllers erase their personal data without undue delay [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/). Organizations must respond to such requests within one month and inform the individual whether erasure has been completed or refused [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

Requests can be made verbally or in writing. The right only applies to data held at the time the request is received and does not extend to data created in the future [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## When the Right to Erasure Applies

Organizations must erase personal data when one of these conditions is met [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain):

The data is no longer necessary for its original purpose
The individual withdraws consent that was the lawful basis for processing
The individual objects to processing based on legitimate interests, with no overriding reason to continue
Processing is for direct marketing and the individual objects
The data was processed unlawfully
Legal obligation requires erasure
Data was collected to offer services to a child

## Major Limitations and Exceptions

Organizations may refuse erasure requests—wholly or partly—when processing is necessary for [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain):

Exercising freedom of expression and information
Compliance with legal obligations
Performance of tasks in the public interest or official authority
Archiving, scientific research, historical research, or statistical purposes where erasure would prevent achievement of those objectives
Establishment, exercise, or defence of legal claims
Public health purposes in the public interest
Preventative or occupational medicine, medical diagnosis, or health/social care management by professionals under confidentiality obligations

Additionally, organizations can refuse requests deemed **manifestly unfounded** or **excessive**. A request may be excessive if it places a disproportionate burden, while a manifestly unfounded request lacks reasonable basis. Organizations must assess each request individually rather than applying blanket policies [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

If refusing erasure, organizations must explain their reasons and inform the individual of their right to complain to the Information Commissioner or seek judicial remedies [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## Special Category Data Protections

For sensitive data (special categories), two additional circumstances apply where erasure does not apply: when processing is necessary for public health in the public interest, or for preventative/occupational medicine under professional secrecy obligations [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

Are you seeking to implement right-to-erasure processes within an organization, or do you need guidance on requesting erasure of your own data?
