Delete Everything Except

An EU customer submits an Article 17 erasure request. Their account holds four years of paid invoices (national tax law requires seven-year retention of accounting records), one open chargeback dispute with their bank, a behavioural marketing profile built under consent they have now withdrawn, and support tickets that quote their home address. What is the defensible response?

Anonymise every record in place. Anonymous data falls outside the Regulation, so this satisfies the request without deleting anything the business needs.

Erase the marketing profile and the withdrawn-consent tracking data, retain the invoices under the legal-obligation ground and the dispute record for the establishment and defence of legal claims, and reduce the support tickets to what the remaining purpose still requires.

Erase everything within one month. Once consent is withdrawn, Article 17 admits no exceptions, and conflicting national retention law is preempted by the Regulation.

Refuse the request in full while any financial record is inside its statutory retention window, and invite the customer to resubmit once the seven years have elapsed.