A data subject requests erasure of personal data that the controller also needs to establish or defend a legal claim. How may the controller respond?
Select an answer to reveal the explanation.
Short Explanation
You cannot wipe the evidence locker just because someone asked for erasure mid-dispute. If you still need the data to bring or defend a legal claim, that is a recognised exception. Erase what you do not need for the fight; keep what the claim still requires.
Full Explanation
Article 17(3) lists exceptions to erasure, including where processing is necessary for the establishment, exercise or defence of legal claims. Controllers may therefore retain relevant personal data for that purpose even when an erasure request is made, while still honouring erasure for data outside that necessity.