This is mainly pertaining computer systems but it applies all around.

Basically a user can create an account. And print invoices with the account. We record who printed what when. If they user requests their personal data is deleted, do we also have to delete the records stating that they printed the invoice on whatever date?

What is the extent of the law that we have to comply with deletion requests?

Lets look specifically at Japan.

closed as too broad by Nij, Singulaere Entitaet, user6726, feetwet Jun 9 '17 at 16:15

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Is this somewhere in the EU? – user6726 Jun 9 '17 at 4:47
  • No it's Japan, but please answer generically, US or EU is fine. – Worthy7 Jun 9 '17 at 5:38
  • "Generically" is not a thing that is possible with privacy regulations unless you specify a jurisdiction. There is variance from one end to the other of possibilities and everything in between. The only possible answer is currently "it depends on who makes the law in the place you are, get a lawyer to tell you what that law says". – Nij Jun 9 '17 at 8:33
  • Ok I updated the question to just apply to Japan. – Worthy7 Jun 12 '17 at 4:50
  • Is Japan in the EU? – user6726 Jun 12 '17 at 4:51

The below document from the Information Commissioner's Office in the United Kingdom provides a great stating point to your question. There is not full parity across the EU yet, although the Data Protection Directive (Directive 95/46/EC) from 1995 will soon be superseded by the General Data Protection Regulation (Regulation (EU) 2016/679), which will serve as a pan-EU standard.

Also of interest in your inquiry will be the national data protection plans for each country (UK's explained in the link below) and the website of either the European Data Protection Board or the Article 29 Data Protection Working Party.

Depending on how specific the info you need is and whether you're focusing on one country or the EU as a whole, this info should be helpful. I truly hope it is - best of luck.


  • Thanks for the info but sorry you're not directly answering my question – Worthy7 Jun 9 '17 at 8:03
  • Just to summarise, after reading the info, it seems in the UK that a delete means you've got to delete records of that persons name - making them almost untraceable - "we know someone from this company printed this on this day" – Worthy7 Jun 9 '17 at 8:09
  • Could you include some kind of summary of the answer from the link? Links go bad, so it's usually encouraged on Stack Exchange that you include a quote or something of the actual answer in the content on this site, so that we don't just have answers that revolve around linking to external sites where the links may end up breaking. – schizoid04 Jun 9 '17 at 14:26
  • Hi, thanks for the comment and clarification. I'll have to note and agree with @Nij that providing an answer to the question is impossible in "generic" terms. I provided the names to key UK and EU docs that provide good examples of the law, but they vary by jurisdiction. To the question: ico.org.uk/for-organisations/guide-to-data-protection/… – A.fm. Jun 9 '17 at 18:57
  • No max or min periods. "Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. In practice, it means that you will need to: review the length of time you keep personal data; consider the purpose or purposes you hold the information for in deciding whether (and for how long) to retain it; securely delete information that is no longer needed for this purpose or these purposes; and update, archive or securely delete information if it goes out of date." – A.fm. Jun 9 '17 at 19:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.