# R7 | deepseek/deepseek-v4-pro | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR’s **right to erasure** (also known as the “right to be forgotten”) gives individuals the power to request deletion of their personal data under specific conditions. It is **not absolute**—the law sets out clear grounds where the right applies and an equally important list of circumstances where it does not. Controllers must respond within one month and must justify any refusal.

## What the right to erasure is

Under **Article 17 of the GDPR**, a person (the data subject) has the right to have personal data erased without undue delay, and the data controller is obliged to comply, if one of the following grounds applies [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain):

- The data is **no longer necessary** for the purpose for which it was collected or processed.
- The individual **withdraws consent** and there is no other lawful basis for processing.
- The individual **objects** to processing based on legitimate interests (and no overriding legitimate grounds exist) or objects to direct marketing.
- The data has been **unlawfully processed**.
- Erasure is required to comply with a **legal obligation**.
- The data was collected in relation to the offer of **information society services to a child**.

These are the *only* grounds that trigger the obligation. If none apply, the controller does not have to erase the data [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## When the right does **not** apply

Article 17(3) explicitly carves out exceptions. The right to erasure does **not** apply to the extent that processing is necessary for:

| Purpose | Explanation |
|---------|-------------|
| Exercising the right of **freedom of expression and information** | Balancing privacy with freedom of speech |
| Compliance with a **legal obligation** | For example, an employer retaining payroll records for tax purposes |
| Performance of a task carried out in the **public interest** or in the exercise of **official authority** | e.g., processing by a public body under a statutory mandate |
| **Public health** reasons in the public interest | Such as serious cross-border health threats or ensuring quality and safety of healthcare |
| **Archiving, scientific or historical research, or statistical purposes** | Where erasure would make processing impossible or seriously impair the research |
| **Establishment, exercise or defence of legal claims** | Preserving evidence or pursuing litigation |

In short, data held under a legal obligation or for a lawful, necessary purpose that falls into one of these categories does not have to be deleted, even if a request is received [eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?qid=1775261725114&uri=CELEX%3A02016R0679-20160504).

## Can a request be refused outright?

Yes. Controllers may refuse to comply if the request is **manifestly unfounded** or **excessive**. These must be assessed case by case—blanket policies are not permitted—and the controller must be able to demonstrate to the individual why the request qualifies. If challenged, the reasoning may need to be explained to the supervisory authority (e.g., the ICO in the UK) [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

## How long do organisations have to respond?

A response must be provided **without undue delay and at the latest within one month** of receiving the request. If the request is refused, the controller must inform the individual of:
- The reasons for not taking action
- Their right to make a complaint to the supervisory authority
- Their ability to seek a judicial remedy

This response period extends to three months if the request is complex, provided the individual is informed within the first month [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/).

The GDPR’s right to erasure is a powerful tool, but its scope is deliberately limited to prevent abuse and to protect interests such as free expression, public health, and legal obligations.

Would you like a walkthrough of how the right to erasure applies specifically to search engines under the EDPB guidelines?
