26. Right to erasure. – (1) The data subject shall have the right to request the data controller to erase his personal data concerning him without undue delay and the data controller shall have the obligation to erase personal data within 14 days where one or more of the following conditions applies: (a) the personal data is no longer necessary concerning the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based under sub-section (1) of section 23 and where there is no other legal ground for the processing; or (c) the data subject objects to the processing under sub-section (2) of section 23; (d) the personal data have been unlawfully processed; or (e) the personal data must be erased for compliance with a legal obligation. (2) Where the data controller has made the personal data public and is obliged under subsection (1) to erase the personal data, therefore, the data controller- taking into account of available technology and the cost of implementation- shall take adequate steps, including technical measures to inform data processors processing the personal data for erasure, along any links to, copy or replication of the personal data. (3) Without prejudicing the rights of the natural person protected under the Act, subsections (1) and (2) shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information as enshrined in the Constitution of the Islamic Republic of Pakistan, 1973; (b) for compliance with a legal obligation or the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (c) for reasons of public interest in the area of public health; (d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in so far as the right referred to in sub-section (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (e) for the establishment, exercise, or defence of legal claims. 27