# R7 | deepseek/deepseek-v4-pro | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The right to erasure — commonly called the “right to be forgotten” — lets individuals ask an organisation to delete their personal data. It is not an absolute right. It applies only when specific legal grounds are met, and even then it is subject to important exemptions. The controller must respond within one month and must justify any refusal.

## What the right to erasure is

Under Article 17 of the UK GDPR (which mirrors the EU GDPR), an individual can request the deletion of personal data that an organisation holds about them. The controller must comply “without undue delay” when one of the listed grounds applies. The right is also referred to as the ‘right to be forgotten’. [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/) [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain)

## When the right applies

An organisation must erase personal data if the individual asks and one of the following conditions is met:

- The data is no longer necessary for the original purpose it was collected or processed for.
- The individual withdraws consent (and no other legal basis exists).
- The individual objects to processing based on legitimate interests or direct marketing, and there is no overriding legitimate interest to continue.
- The data has been processed unlawfully.
- Erasure is required to comply with a legal obligation.
- The data was collected from a child in connection with information society services. [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/) [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain)

## Main limitations and when the right does not apply

The right to erasure is **not absolute**. The GDPR lists several circumstances where a request can be refused. The right does **not** apply if processing is necessary for:

- **Exercising the right of freedom of expression and information.** This protects journalistic, academic, artistic, and literary expression.
- **Complying with a legal obligation.** If the controller is required by law to keep the data, the right to erasure is overridden.
- **Performing a task in the public interest or exercising official authority.**
- **Public health purposes** in the public interest (e.g., protecting against serious cross-border health threats, ensuring safety of medicines or medical devices).
- **Archiving in the public interest, scientific or historical research, or statistical purposes**, where erasure would render impossible or seriously impair the processing.
- **Establishing, exercising, or defending legal claims.** [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/) [legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/17?view=plain) [commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en)

Additionally, the right to erasure **does not apply to data that has not yet been created** — it only covers data held at the time of the request. [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

## Practical limitations and the controller’s response

- **Manifestly unfounded or excessive requests:** A controller can refuse a request that is clearly baseless or repeats previous requests, but they must assess each case individually and explain why. [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **One-month deadline:** The controller must respond without undue delay and at most within one month, informing the individual whether data has been erased or the request has been refused — and, if refused, explaining the reasons and the right to complain to the supervisory authority or seek a judicial remedy. [ico.org.uk](https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **Non-automatic deletion:** Even where a ground for erasure seems present, controllers can reject requests if one of the legal exceptions applies. The burden is on the controller to justify the refusal. [commission.europa.eu](https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en)

The right to be forgotten also includes a specific application regarding **search engines**, where individuals may request delisting of certain results. The European Data Protection Board has issued detailed guidelines on how to balance privacy rights with the public’s right to access information in that context. [edpb.europa.eu](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation_en.pdf)

Would you like a practical example of how an organisation might handle a request for erasure when one of the exemptions applies?
