5 / 6 PII, GDPR, Residency & Audit

Delete Everything Except

An EU customer submits an Article 17 erasure request. Their account holds four years of paid invoices (national tax law requires seven-year retention of accounting records), one open chargeback dispute with their bank, a behavioural marketing profile built under consent they have now withdrawn, and support tickets that quote their home address. What is the defensible response?

A

Anonymise every record in place. Anonymous data falls outside the Regulation, so this satisfies the request without deleting anything the business needs.

B

Erase the marketing profile and the withdrawn-consent tracking data, retain the invoices under the legal-obligation ground and the dispute record for the establishment and defence of legal claims, and reduce the support tickets to what the remaining purpose still requires.

C

Erase everything within one month. Once consent is withdrawn, Article 17 admits no exceptions, and conflicting national retention law is preempted by the Regulation.

D

Refuse the request in full while any financial record is inside its statutory retention window, and invite the customer to resubmit once the seven years have elapsed.