Deletion requests are a bit fuzzy. Withdrawing consent is easy, some deletions are easy but we need to remember that the GDPR have a carve out "for the establis

Deletion requests are a bit fuzzy. Withdrawing consent is easy, some deletions are easy but we need to remember that the GDPR have a carve out "for the establishment, exercise or defence of legal claims." In practice this means that companies will keep data, and are entitled to keep data, for the period a legal claim may be made. For instance in the UK that period is 6 years and so you will find that companies will keep data for 6-7 years.