> The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is

> The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. Best practice now may not be best practice in future. Sure, there could be guidance produced. In fact there is, it's just usually by the enforcing bodies. > what happens when a user exits the contract > to avoid user cancelling, asking for deletion then registering for another free trial You can be sued for six years in the UK. Other jurisdictions I'm not so sure about. If you're providing a service and have agreed a jurisdiction and can be sued in that jurisdiction, there's your lawful basis. The right to be forgotten only applies where the basis is purely consent. If you withdraw consent, and consent is the only basis, your data should be deleted. But if you're providing a service, then another basis applies: contract and legitimate business interest. I think you'll find you have a legitimate business interest and a lawful purpose there for maintaining the email addresses -- as long as you don't later change the purpose and include them on a mailing list. > So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law. It's largely down to the enforcing body. The ICO (UK enforcing body) generally only fine after a major incident or you've failed to stop doing something really bad. Or you've set up a business that is egregiously scummy. You can read the list of fines online. [0] It helps to see it more like fire legislation -- there are many ways to prevent and contain fire. You can seriously reduce the risk of fire and the consequences if one happens. Breaches are similar. If you have a data breach, something's gone wrong. If you're not taking serious mitigation to prevent that from happening, then maybe you shouldn't be taking user data in the first place. [0] https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/