Erasure request despite a retention duty: restriction and access block

An erasure request still requires a full assessment when certain records must be retained by law. The business must define the relevant data, prove the specific duty and restrict further processing to that purpose. A blanket statement that everything remains stored does not reflect the right to erasure under Article 17 GDPR.

This article explains how a business can handle such a request. It focuses on the exception in Article 17(3)(b) GDPR, practical restrictions on use, a traceable internal access block and the response to the data subject. General deletion concepts and applicant data are separate topics.

Article 17(1) GDPR gives the data subject a right to erasure where the stated conditions apply. The business therefore starts with a positive assessment: which data is concerned, for what purpose is it processed and does that purpose still exist? Only then should it consider whether an exception applies to particular data.

Article 17(3)(b) GDPR excludes the right to erasure to the extent that processing is necessary for compliance with a legal obligation requiring processing under Union or Member State law. The exception is limited to what is necessary. It does not automatically preserve every item that was once connected with a contract, customer contact or business matter.

One request may concern several data categories. Accounting or tax records may follow a different duty from free notes, distribution lists, copies or internal working files. The article on the erasure concept for customer and lead data covers general organisation of data sets. This article addresses the specific response to an erasure request despite a duty to retain.

A defensible decision identifies the specific duty, the record concerned and the retention purpose. Record why this information is needed, who must retain it and when the duty ends or must be reviewed. An internal policy may organise the process, but it does not create the legal basis.

The duty must be separated from the technical storage location. A document may contain many personal details even though only part of it is needed for the statutory purpose. Assess whether fields, attachments or copies can be handled separately. If the duty covers a particular record, the remaining data should not be attached to it merely for convenience.

The source and distribution of the data also matter. Identify the primary file, digital copies, email attachments, exports, backups and provider access. Where a processor is involved, compare the legal decision with the actual system processes. The article on a data breach at a processor shows why roles and data flows should be recorded separately.

Necessary storage initially means only that data must be kept for the defined retention purpose. It does not permit free reuse for marketing, new analysis, general customer management or any internal search. Article 5(1)(b), (c) and (e) GDPR require purpose limitation, data minimisation and storage limitation.

In practice, further use can be restricted through technical and organisational measures. Remove data from active search views, disable automatic exports, limit roles and record permitted access. Access needed to fulfil the statutory duty or assess a specific claim is different from routine operational use.

Article 18 GDPR provides a right to restriction for specific statutory situations. The mere existence of a retention duty does not automatically trigger Article 18. A business should therefore distinguish the legal restriction of the erasure right, a restriction under Article 18 and an internal access block that protects permitted retention in practice.

An access block is an internal organisational and accountability measure in this setting. It should show which data remains stored despite the request, which specific duty supports the storage and which use remains permitted until the duty ends. The term access block does not replace the legal assessment and must not become a blanket retention reason.

The note should include at least the request, the data subject, data categories and systems, the legal basis, the permitted purpose, authorised roles, technical implementation, the next review point and the responsible area. If data has been transferred, assess how the restriction is represented at those recipients.

The note must work in daily operations. A mark on a file is insufficient if staff can still edit the data in an open customer view or export it automatically. Review permissions, searchability, interfaces and backups. Article 24 GDPR requires the controller to be able to demonstrate compliance.

The data subject should receive a clear response identifying what was erased, what remains stored and why. A partial outcome should be itemised. Refer to the relevant data categories and explain why the statutory duty requires continued storage to the necessary extent.

Article 12(3) GDPR requires a response without undue delay and generally within one month. An extension may be possible for complex or numerous requests, and the data subject must be informed within that period. Article 12(4) GDPR requires reasons for a failure to act and information about the possibility of complaining to a supervisory authority and seeking a judicial remedy.

The response should not confuse an internal access block with full erasure. Saying that data is restricted does not explain whether it was erased, anonymised or retained because of a legal duty. The article on Article 15 access requests explains the general handling of data subject requests and the need for a traceable process.

A retention duty does not end because an access block was recorded. For each data category, define the event that triggers the next review. This may be the end of a statutory period, the loss of the statutory purpose or a change in the facts. An open-ended statement such as “until further notice” is not a sufficient control.

The review must include copies. Email attachments, local downloads, database exports, backups and provider storage may continue independently from the primary file. Whether and how they must be erased, overwritten or technically isolated depends on the system and the duty and should be documented.

Once the necessary storage ends, apply Article 17(1) GDPR again. Assess which data can be erased or anonymised, which access rights end and how completion will be evidenced. Any later processing for legal defence or another purpose requires its own assessment and must not be silently attached to the former duty.

Start with the request and a data map. Record the data subject, data types, records, systems, recipients and current purposes. Then assign each group an outcome: erase, retain or restrict active use for a specifically assessed purpose.

Record the statutory duty and its concrete scope. Assess whether it covers the whole record or only particular information. Then adjust roles, search views, exports, interfaces and provider access. The access block must match the actual technical configuration and trigger a later deletion review.

The file should contain the response, deadline record, explanation of a partial refusal and evidence of the access restriction. Also record when retention will be reviewed. This keeps clear why data is stored today and when erasure becomes possible again.

We review the request, data set, statutory duty, permitted use, access block, response and later deletion against the actual process. For an initial assessment, the erasure request, relevant records, the retention rule, system and recipient overviews and the deletion process are useful. Contact us when data must remain stored but its use also needs a traceable restriction.