# R7 | perplexity/sonar-pro | run 2

## Prompt

Explain the GDPR 'right to erasure' (right to be forgotten): what it is and its main limitations. Cite official sources.

## Response

The GDPR **right to erasure**—also called the **right to be forgotten**—gives a person the right to ask a controller to delete their personal data without undue delay when certain legal grounds apply, such as when the data is no longer needed, consent is withdrawn, or the processing is unlawful.[2](https://gdpr-info.eu/art-17-gdpr/)[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

## What it is

Under Article 17, an individual can request erasure when, for example, the data is no longer necessary for the original purpose, consent has been withdrawn and no other legal basis exists, the person objects and there are no overriding legitimate grounds, the data was processed unlawfully, or deletion is needed to comply with a legal obligation.[2](https://gdpr-info.eu/art-17-gdpr/)[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

The ICO explains that the right applies to personal data held at the time the request is received, not to data that may be created in the future.[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

## Main limitations

The right is **not absolute**.[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/) GDPR Article 17 and the ICO say erasure can be refused where processing is necessary for:

- **Freedom of expression and information**.[2](https://gdpr-info.eu/art-17-gdpr/)[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **Compliance with a legal obligation**.[2](https://gdpr-info.eu/art-17-gdpr/)[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **Tasks carried out in the public interest or under official authority**.[2](https://gdpr-info.eu/art-17-gdpr/)[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **Archiving, scientific research, historical research, or statistical purposes** where erasure would seriously impair the processing.[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)
- **The establishment, exercise, or defence of legal claims**.[2](https://gdpr-info.eu/art-17-gdpr/)[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

The ICO also notes specific situations where erasure may apply only in limited circumstances, such as direct marketing, children’s information society services, and cases where the organization’s lawful basis changes or falls away.[1](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/)

If you want, I can also give you a one-paragraph plain-English version or a checklist for when an erasure request must be granted.
