A customer requests erasure of all personal data, including an invoice the controller must retain under tax law. How should the controller respond?
Select an answer to reveal the explanation.
Short Explanation
Erasure is powerful, but it is not a magic shredder that beats every statute. If tax law says keep the invoice, you keep that piece and clear out what you no longer need. Rights and legal duties share the filing cabinet.
Full Explanation
The right to erasure is powerful but expressly limited. When a customer requests erasure of all personal data including an invoice the controller must retain under tax law, the controller should refuse erasure of the invoice to the extent retention is necessary for a legal obligation, while deleting or restricting other personal data that are no longer needed. Scope the response: erase what can be erased; keep what the law still requires.
Deleting every record immediately because erasure “always overrides” tax statutes invents a hierarchy GDPR does not create. Ignoring the erasure request until the entire tax retention period expires years later fails to honour erasable portions now. Transferring the invoice to a marketing vendor to claim the controller “no longer holds it” is not a lawful erasure strategy and may worsen compliance.
Exam caveat: legal-obligation exceptions are narrow shields for specific records—not a licence to ignore the whole request. Operational check: segregate legally retained fields, erase or anonymise the rest, document the statutory basis for what remains, and explain the partial outcome to the requester. Public and private bodies alike should show residents that retention for law is disciplined, not a pretext for keeping everything forever.