I am creating a company that offers a certain service to private individuals and professionals. I know that if someone wants to delete his/her account, we have the obligation to grant the user this request. My question is: which information must be deleted? Which one can be kept? Which one must be kept?

Let's say that our service allows someone to make an order. The order is then charged to the user. Wouldn't we (at the company) be obligated to know which person made which orders, and which person paid for the orders? I think that these information must be kept even if the user wants to delete his/her account.

My question is: how do I know which information am I obligated to delete if the user does such a request? The company is based in France.

  • You're generally allowed to keep anything that is required for legal record keeping or to protect your company from abuse. But aside from the law aspect, making sure you delete all information you don't actually need, even if not required to do so, when a user is deleted is just good policy that instills trust in your customers. – animuson Apr 14 '17 at 17:08
  • @K-C I was thinking more towards the customers who demand it but you refuse because "we're not required to" rather than just deleting unneeded information and saying "we kept what we're legally required to keep". Upset customers also tend to be the loudest, and having people going around spreading that you keep every fact about a user against their wishes isn't ideal. – animuson Apr 14 '17 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.