A customer requests erasure of all personal data, including an invoice the controller must retain under tax law. How should the controller respond?
Select an answer to reveal the explanation.
Short Explanation
Erasure is powerful, but it is not a magic shredder that beats every statute. If tax law says keep the invoice, you keep that piece and clear out what you no longer need. Rights and legal duties share the filing cabinet.
Full Explanation
Article 17 provides a right to erasure but also lists exceptions, including where processing is necessary for compliance with a legal obligation. Tax retention duties can therefore justify keeping invoice data for the required period. Controllers should still erase or cease other processing that is not covered by an exception.