# R7 | openai/gpt-5.4-mini | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR’s **right to erasure** lets a person ask an organization to delete personal data about them in specific situations, and it is often called the **“right to be forgotten.”** The European Commission says it applies, for example, when the data is no longer needed, processing is unlawful, or the person withdraws consent and there is no other legal basis to keep processing it. ([commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en?utm_source=openai))

## What it is

Under Article 17 GDPR, a controller must erase personal data without undue delay when one of the listed grounds applies, including:
- the data is no longer necessary for the purpose it was collected for,
- the person withdraws consent and there is no other lawful basis,
- the person objects and there are no overriding grounds,
- the data was processed unlawfully,
- erasure is needed to comply with a legal obligation,
- the data was collected from a child in relation to information society services. ([commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en?utm_source=openai))

The right can also require a controller that made data public to take reasonable steps to inform other controllers that are processing that data to erase links to it, copies of it, or replications of it. ([commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en?utm_source=openai))

## Main limitations

The right to erasure is **not absolute**. The GDPR lists exceptions where deletion is not required, especially when processing is necessary for:
- exercising the right to freedom of expression and information,
- compliance with a legal obligation,
- reasons of public interest in the area of public health,
- archiving in the public interest, scientific or historical research, or statistical purposes, where erasure would seriously impair those aims,
- the establishment, exercise, or defence of legal claims. ([commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en?utm_source=openai))

In practice, the European Commission also notes that companies may refuse erasure when they need the data to comply with a legal retention duty or for legal claims, and the EDPB has recently emphasized that controllers must weigh the erasure request against other rights and legal obligations. ([commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/dealing-requests-individuals/do-we-always-have-delete-personal-data-if-person-asks_en?utm_source=openai))

## Practical takeaway

If the data is still needed for a lawful purpose, must be kept by law, or is protected by another important interest such as free expression or legal defense, the erasure request can be limited or denied. If none of those exceptions apply, the controller should delete the data and, where relevant, try to pass that deletion request along to others who received the data. ([commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en?utm_source=openai))

Would you like a one-paragraph version of this for a memo or policy document?
