gdpr
Under the GDPR, should transaction data be deleted on account deletion or on user request?
<p>Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted?</p>

<p>Or if the user can buy without having an account on the website, but just by specifying their email every time they purchase something, should the entire record be deleted or just clear the personal data (email) in the record?</p>

<p>This will depend partly on what you use the e-commerce website for. If it is simply a point-of-sales and your accounting records are kept elsewhere, then it may be possible to delete their account including associated orders and payments, though you should check that the software doesn't simply update the record by setting the value for a column named <code>deleted</code> or <code>del</code> for short to <code>1</code> instead of <code>0</code> to identify deleted records, but instead actually deletes the record from the database. You should consider how you will refund a customer if required after doing so!! (i.e. perhaps you acknowledge the request but keep the information for at least as long as the customer is eligible for a refund, and then delete it).</p>

<p>If the system is also used for accounting records, then if a customer/user wishes to assert their right to be forgotten, it is likely you'll need to disable the account and apply some kind of pseudonymisation (essentially replacing personal identifiers such as name, email address, date-of-birth, with dummy/null data), in order to preserve the integrity of your financial records. </p>

<p>For example, in the UK, there is a statutory obligation on companies to retain financial records for at 7 years. In cases where data cannot be immediately erased due to other legitimate reasons for which it must be kept, once those retention periods expire the data must be erased.</p>

<p>You'll need to keep a record of anyone that requests to be forgotten, and remember to follow-up to complete erasure at the appropriate dates if it can't be done immediately, and when the data is destroyed the user needs to be informed.</p>
