# R7 | openai/gpt-5.6-luna | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR’s **right to erasure**, commonly called the “right to be forgotten,” allows an individual to ask a data controller to delete personal data about them. It is **not an unconditional right**: erasure is required only when specified grounds apply, and several important exceptions allow data to be retained. [1](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

## What the right covers

Under **Article 17 GDPR**, a person may require erasure “without undue delay” when, for example:

- The data is no longer necessary for the purpose for which it was collected.
- The person withdraws consent, and there is no other lawful basis for processing.
- The person successfully objects to processing and no overriding legitimate grounds exist.
- The data was processed unlawfully.
- Erasure is required to comply with a legal obligation.
- The data was collected in connection with online services offered directly to a child. [1](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

The request is made to the **controller**—the organisation deciding why and how the data is processed. If the controller made the data public, it must take reasonable steps to inform other controllers processing the data that the individual has requested deletion of links, copies, or replications, taking account of available technology and implementation costs. [1](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

## Main limitations

| Limitation | What it means |
|---|---|
| **Freedom of expression and information** | Erasure may be refused where retaining the data is necessary to protect journalism, public debate, or other expression and information rights. |
| **Legal obligations** | An organisation may retain data where EU or national law requires it—for example, certain tax, employment, accounting, or regulatory records. |
| **Public interest and official authority** | Data may be retained when necessary for a public-interest task or the exercise of official authority. |
| **Public health** | Retention may be justified for specified public-health reasons. |
| **Archiving, research, and statistics** | Erasure may be refused where deletion would seriously impair public-interest archiving or scientific, historical, or statistical purposes, subject to the GDPR’s conditions. |
| **Legal claims** | Data may be kept to establish, exercise, or defend legal claims. |
| **Another lawful basis remains** | Withdrawing consent does not require deletion if the controller can lawfully process the data on a different basis. |
| **Practical limits on online deletion** | A controller must take reasonable steps to notify other controllers, but Article 17 does not guarantee that every copy, cache, repost, backup, or independently controlled website will disappear. |
| **Excessive or unfounded requests** | A controller may charge a reasonable fee or refuse to act when a request is manifestly unfounded or excessive, particularly because of its repetitive character. It may also request information reasonably necessary to verify identity. [2](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) |

The exceptions are set out directly in **Article 17(3)**, while **Recital 65** explains that the right must be balanced against expression, legal duties, public interests, research, archiving, statistics, and legal claims. [3](https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1510829288571&uri=CELEX%3A32016R0679+)

## Procedure and timing

A controller generally must respond **within one month** of receiving the request. That period may be extended by up to two additional months if the request is complex, but the controller must explain the delay within the first month. [4](https://www.edpb.europa.eu/contact/frequently-asked-questions_ga)

If the controller refuses, it must explain the reasons and inform the person of the right to complain to a data-protection authority or seek a judicial remedy. [2](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

## What it does not mean

The right to erasure is **not**:

- A general right to remove lawful and accurate information from the internet.
- A right to override freedom of the press or public access to information.
- A guaranteed right to erase legally required records.
- A mechanism for deleting data held by organisations that are outside the controller’s control.
- Always the same as removing a search-engine result: delisting from search results can be a separate issue from deleting the source material.

In short, the GDPR creates a conditional right to have personal data deleted when continued processing is no longer justified, unlawful, or otherwise covered by Article 17. Its strongest boundaries arise where deletion would conflict with expression, legal duties, public interests, research, archiving, or legal claims. [1](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

Would you like a practical template for submitting a GDPR erasure request?
