# R7 | x-ai/grok-4.3 | run 1

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

**The GDPR right to erasure, also known as the "right to be forgotten," allows individuals to request that controllers delete their personal data without undue delay when specific conditions are met.** It is defined in Article 17 of the GDPR. The right applies only under listed grounds and is subject to explicit exceptions that limit its scope.[[1]](https://gdpr-info.eu/art-17-gdpr/)

## What the Right Entails

Article 17(1) states that data subjects can obtain erasure where one of the following applies:  
- The data are no longer necessary for the original purposes.  
- Consent is withdrawn and no other legal basis exists.  
- The individual objects to processing under Article 21 with no overriding legitimate grounds.  
- Processing was unlawful.  
- Erasure is required by a legal obligation.  
- Data were collected in the context of offering information society services to a child.[[1]](https://gdpr-info.eu/art-17-gdpr/)

Controllers must also take reasonable steps to inform other controllers processing publicly disclosed data of the erasure request, considering available technology and costs.[[1]](https://gdpr-info.eu/art-17-gdpr/)

## Main Limitations

The right is not absolute. Article 17(3) provides that paragraphs 1 and 2 do not apply where processing is necessary for:  
- Exercising freedom of expression and information.  
- Complying with a legal obligation or performing a task in the public interest or official authority.  
- Reasons of public interest in public health.  
- Archiving, scientific/historical research, or statistical purposes (where erasure would seriously impair those objectives).  
- Establishing, exercising, or defending legal claims.[[1]](https://gdpr-info.eu/art-17-gdpr/)

Additional practical limits include the obligation to act only "without undue delay" (typically interpreted as one month), reasonable verification of the requester's identity, and the controller's ability to refuse requests that fall under the exceptions after balancing interests.[[2]](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en)

**For the authoritative legal text, consult the full GDPR directly.** How does this interact with similar rights in other jurisdictions you are considering?
