Any lawyer even vaguely familar with GPDR wouldn't be worried about this. There is a text that states: "processing is necessary for the performance of a contrac

Any lawyer even vaguely familar with GPDR wouldn't be worried about this. There is a text that states: "processing is necessary for the performance of a contract to which the data subject is party.." and "processing is necessary for compliance with a legal obligation to which the controller is subject". It could be easily argued that providing an end customer with access to digital products they bought is part of the service that data subjects signed up for, so retaining PII indefintely is 100% allowed (unless the data subject explicitly requets their account to be permanently deleted). [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/