# R7 | mistralai/mistral-small-2603 | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The **GDPR right to erasure** (commonly called the "right to be forgotten") lets individuals request the deletion of their personal data under defined conditions. It is not absolute and includes several key exceptions, such as cases involving legal claims, public health, freedom of expression, archiving, and compliance with legal obligations. Controllers must respond to valid requests within one month and may refuse if the request is manifestly unfounded or excessive.

**What the right to erasure is**
Under Article 17 of the UK GDPR and the EU GDPR, individuals can request erasure if their data is no longer necessary for its original purpose, they withdraw consent (where consent is the legal basis), they object to processing based on legitimate interests and there is no overriding ground, processing is for direct marketing and the individual objects, processing is unlawful, or it is required to comply with a legal obligation. Special conditions apply to health/social care data processed by professionals under confidentiality obligations or for public health purposes in the public interest [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)[eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504)[legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain).

**Key limitations**
The right does not apply when processing is necessary to:
- exercise freedom of expression and information
- comply with a legal obligation
- perform a task in the public interest or in official authority
- archive public interest data, conduct scientific/historical/statistical research (if erasure would impair the purpose)
- establish, exercise, or defend legal claims [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)[eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504).

Controllers must refuse requests that are manifestly unfounded or excessive and inform the individual, including their right to complain to a supervisory authority or seek judicial remedy, within one month of receipt [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

What situation or type of data processing interests you most when considering this right?
