# R7 | perplexity/sonar-pro | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR **“right to erasure” (right to be forgotten)** gives individuals a qualified right to have their personal data deleted when certain legal grounds apply, but this right is **not absolute** and is subject to significant exceptions and practical limitations.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure) It mainly applies when data are no longer needed, consent is withdrawn, processing is unlawful, or certain objections succeed, but it does not override freedoms such as freedom of expression, legal obligations, or public interest needs.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

## What the GDPR right to erasure is

**Legal basis and scope**

- The **right to erasure** is laid down in **Article 17 GDPR**, titled “Right to erasure (‘right to be forgotten’).”[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- It gives the **data subject** the right to obtain erasure of personal data concerning them “without undue delay,” and imposes a corresponding obligation on the controller to erase that data where legal grounds are met.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- Supervisory authorities (e.g. UK ICO, Dutch Autoriteit Persoonsgegevens) describe it as the **right to have personal data erased**, also known as the **right to be forgotten**.[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)

**When individuals can demand erasure (main grounds)**

Article 17(1) sets out the situations in which erasure must be granted:[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)

- **Data no longer necessary**: The personal data are no longer needed for the purposes for which they were collected or otherwise processed.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **Consent withdrawn**: The data subject withdraws consent and there is no other legal ground for processing.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)
- **Successful objection to legitimate interests**: The data subject objects under Article 21(1), and there are no overriding legitimate grounds for the processing.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- **Direct marketing objection**: The data subject objects to processing for direct marketing purposes under Article 21(2).[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **Unlawful processing**: The personal data have been processed unlawfully, e.g. without a valid legal basis.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)
- **Legal obligation to erase**: Erasure is required to comply with a legal obligation in EU or Member State law.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)
- **Children and information society services**: Data were collected in relation to the offer of information society services to a child (e.g. online services), making erasure especially protective in that context.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

Supervisory authorities emphasize that the right **only applies to data held at the time the request is received**, not to data that may be created later.[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

## Main legal limitations and exceptions

Article 17 expressly limits the right to erasure through a set of **exceptions**, many of which are mirrored in official guidance.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)

### 1. Freedom of expression and information

- Controllers may **refuse erasure** where processing is necessary **“for exercising the right of freedom of expression and information.”**[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- National authorities highlight this as a core limitation: for instance, the Dutch DPA states that the exception ensures that privacy and freedom of speech are treated as **equivalent fundamental rights**.[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)
- In practice, this means an individual typically cannot use the right to erasure to remove lawful journalistic content or critical reporting simply because it is unfavorable.[Cloudflare explainer](https://www.cloudflare.com/learning/privacy/right-to-be-forgotten/)

### 2. Compliance with legal obligations

- The right does not apply where processing is **necessary to comply with a legal obligation** imposed by Union or Member State law.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- Authorities explain that organizations can retain data when they are legally required to do so (e.g. tax, accounting, employment or regulatory record‑keeping).[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)[noyb guidance](https://noyb.eu/en/your-right-erasure-article-17)
- As a result, even if a person requests deletion, a controller may lawfully keep certain records for as long as statutory retention periods demand.

### 3. Public interest and official authority

- Erasure can be refused where processing is necessary **“for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”**[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- National guidance lists examples such as tasks set out by law or public‑interest functions.[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)
- This limitation often covers public authorities and certain private bodies carrying out legally mandated public functions.

### 4. Public health, scientific, historical and statistical research

- Article 17(3) exempts processing necessary **for reasons of public interest in the area of public health** and for **archiving in the public interest, scientific or historical research or statistical purposes** when erasure would render such processing impossible or seriously impair it.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- Supervisory authorities echo this: erasure may be refused if deletion would seriously impair or render processing of statistical, historical or scientific information impossible.[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)[noyb guidance](https://noyb.eu/en/your-right-erasure-article-17)
- This means, for example, that data used in long‑term epidemiological studies or official archives may be retained despite an erasure request, subject to safeguards.

### 5. Legal claims

- Processing can continue where data are **necessary for the establishment, exercise or defence of legal claims**.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- Authorities specify that organizations may keep data needed to take or respond to existing legal claims.[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)[noyb guidance](https://noyb.eu/en/your-right-erasure-article-17)
- Practically, this limits erasure where litigation, complaints or enforcement actions make the data evidentially necessary.

## Practical and procedural limitations

Beyond the legal exceptions, official and quasi‑official guidance identifies several **practical limitations** on how the right operates.

### 1. Not an automatic deletion of all data everywhere

- The right covers **personal data held by the controller at the time of the request**; it does not automatically apply to future data or to non‑personal information.[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- It applies only where **no legal ground remains** and none of the Article 17(3) exceptions are triggered; individuals must consider whether processing is lawful before demanding erasure.[noyb guidance](https://noyb.eu/en/your-right-erasure-article-17)

### 2. Territorial and technical limits (especially online/search)

- The GDPR applies primarily to processing within its territorial scope; for search engines, erasure (or de‑indexing) may be limited to **EU/EEA versions of search results**, while results may still appear in other jurisdictions.[Cloudflare explainer](https://www.cloudflare.com/learning/privacy/right-to-be-forgotten/)
- Controllers must erase and, where appropriate, inform other controllers processing the same data, but there can be technical limits (e.g. backups that are put “beyond use” rather than immediately destroyed).[Jetico guide](https://jetico.com/blog/how-right-erasure-applied-under-gdpr-complete-guide-organizational-compliance/)

### 3. Time to respond and possibility of refusal

- Controllers generally have **one month** to respond to a request, either by erasing the data or explaining why erasure is not possible under the GDPR.[Cloudflare explainer](https://www.cloudflare.com/learning/privacy/right-to-be-forgotten/)
- Organizations may **refuse a request** where any of the legal exceptions apply, or where the request is manifestly unfounded or excessive (the latter point is articulated in broader GDPR guidance, though not in Article 17 itself). Official national guidance repeatedly states that **not all deletion requests must be fulfilled**.[Jetico guide](https://jetico.com/blog/how-right-erasure-applied-under-gdpr-complete-guide-organizational-compliance/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)

### 4. Backups and “beyond use”

- Some guidance notes that **backup copies** may remain until overwritten according to retention schedules, but must be put **“beyond use”**, meaning they cannot be accessed or processed for any other purpose.[Jetico guide](https://jetico.com/blog/how-right-erasure-applied-under-gdpr-complete-guide-organizational-compliance/)
- This shows that “erasure” under the GDPR is functionally about stopping processing and normal access, not necessarily physically deleting every copy immediately.

## Summary of the main limitations

Putting the above together, the key limitations of the GDPR right to erasure are:

- It is **conditional**, not absolute: it applies only when specific grounds in Article 17(1) are met.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)
- It is **subject to explicit exceptions** for freedom of expression and information, legal obligations, public‑interest and official‑authority tasks, public health, research/archiving, and legal claims.[Art. 17 GDPR](https://gdpr-info.eu/art-17-gdpr/)[ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)[Dutch DPA](https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-erasure)
- It does **not guarantee removal of all references** to an individual online or globally (especially in non‑EU jurisdictions or in journalistic/public‑interest content).[Cloudflare explainer](https://www.cloudflare.com/learning/privacy/right-to-be-forgotten/)
- Controllers may retain data where **other rights or obligations override** the individual’s request, and may delay physical deletion in backups provided the data are no longer used.[Jetico guide](https://jetico.com/blog/how-right-erasure-applied-under-gdpr-complete-guide-organizational-compliance/)

Would you like a short, practical checklist for when an organization must grant or can refuse a right‑to‑erasure request under Article 17 GDPR?
