An ex-employee sends your organization a formal request to erase all their personal data under the "Right to be Forgotten." You realize some of their data is tied to internal documentation, audit logs, and past email threads essential for ongoing regulatory compliance and internal investigations.

How would you respond to this request?

• What legal basis would you use to accept or deny the request?
• Which exceptions apply (if any)?
• What would your response email to the data subject broadly include?

Be specific about the legal reasoning (under GDPR or DPDPA), and highlight any operational steps you'd take before responding.