3 ms·
I think that the best way to view the deletion policy is to imagine what would happen if someone stole the data. If it is anything that could get you sued over
by belorn 8y ago
I think that the best way to view the deletion policy is to imagine what would happen if someone stole the data. If it is anything that could get you sued over then that is data that needed to be deleted.
This will likely cover a bit more than if it was physical objects. To be fair, most physical paper address books would not include millions/billions of addresses, and would unlikely be stolen by accident. The only one that has billions of paper letters are the post office which is regulated. The physical world is not very different to GDPR if one includes the context of how many book shelves of information is being stored on companies databases.
- CWuestefeld 8y agoI don't think that's correct. A business has the right to retain records that are necessary for them to do business. From the lawyer that advised us in this, his call was that Order History data doesn't need to be expurgated even though it contains the person's name and address, etc. There are any number of business reasons dictating that we need a record of this stuff (e.g., auditing for sales tax compliance; being able to handle customer returns in the future, or fraud claims from the credit card processor).