I assume (but I don't know) that GDPR applies fully if any party is in/from the EU. (In practice, if the data processor is outside the EU, enforcement might be

I assume (but I don't know) that GDPR applies fully if any party is in/from the EU. (In practice, if the data processor is outside the EU, enforcement might be difficult, but in your case it sounds like the data processor is inside the EU, so I imagine you have the same rights in this case as those who do reside in the EU.) However, my understanding is that 1) if your data is processed for contractual purposes, the data processor has a right not to delete it on request 2) if your data is processed for law enforcement purposes, the data processor has a duty not to delete it on request There are several legal grounds for processing personal data under GDPR, and consent is only one of them. I think most of the others outweigh any request for deletion by the data subject.