> Would that even be allowed? GDPR specifically carves out an exception, allowing companies to store data for the sole purpose of making sure it stays deleted.

> Would that even be allowed? GDPR specifically carves out an exception, allowing companies to store data for the sole purpose of making sure it stays deleted. I don't think generally the idea is to store all the "deleted" data and scrub it from the output but just to store some key. E.g. it's permissible to store first name/last name/date of birth, so you can ensure a specific persons data does not accidentally re-enter a database. So... maybe? There's something to be argued here for sure and I suspect we'll see that argument play out in court sooner or later.