When new users sign up on my software as a service platform they have to agree to the terms and conditions. That they did so is stored in a database record along with the revision of the legal documents that are in effect at the time of the sign up.
When a user requests the deletion of the account I obviously should delete all data I have about the user.
However, my gut feeling says that I should at least keep the email address – this is how users identify themselves on my platform – as well as the database record about the agreement to the terms and conditions. Just in case I get sued.
This means I would keep some personal data of the user after the account was closed. Do you know any restrictions in Germany – where my business is located – or from any other jurisdiction that don't allow me to do so?