software gdpr privacy data-protection
GDPR: What data am I allowed to keep after a user requests deletion?
<p>I struggle to find an insightful article on what, specifically, I have to delete and what I don't have to delete when a user requests deletion of their data.</p>
<p>Some things are obvious to me: personal information like name, email and any text/images/content they added etc.</p>
<p>What's less obvious to me:</p>
<ul>
<li>Do I have to delete our <em>internal</em> user ID (never shown to anyone on the platform, except possibly to the user themselves)?</li>
<li>Do I have to delete statistics about how this - after deletion anonymous - user used the platform, e.g. which pages they visited? They're on our own server.</li>
</ul>

<p><a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Art. 17 GDPR</a>, Right to erasure (‘right to be forgotten’) requires “erasure of personal data concerning him or her”. That’s <em>all</em> personal data.</p>
<p>However, this only applies when this article applies. Section 1 details when this is and sections 2 and 3 detail limitations and exceptions to the right of erasure. For example, you would be allowed to keep financial records that you're legally obligated to keep. So, <em>if</em> they have the right, you have to delete all their <strong>personal</strong> data that is not exempted.</p>
<p>Aggregate statistics and other anonymous data in the sense of <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">Recital 26</a> are not personal data and don't have to be deleted. Whether the kinds of data you have mentioned would be sufficiently anonymous would require further analysis.</p>
