4 ms·

Thank you! This was very helpful!

• ocdtrekkie 8y ago
  As an example, Google Cloud has granted itself up to 180 days to ensure customer deleted data is fully purged: https://cloud.google.com/terms/data-processing-terms#6-data-deletion https://cloud.google.com/terms/data-processing-terms#6-data-... so as long as it isn't crazy, you are probably safe as long as the right design is in place to ensure deleted data doesn't get accidentally restored. With regards to keeping a list of deleted users for your retention window to re-delete, another suggestion if it's not super difficult to implement (depends on your databases, I suppose), is it is even better if your list of deleted users to remember to delete if you restore a backup is using like a record ID instead of an email address, for instance, if possible. The less personal information you retain for the least amount of time after someone requests deletion, the better. But backups are an obvious business need, and GDPR is cognizant of that. You just need to remember that everything you do with user data should be transparent and should have a justifiable reason for doing it.