Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users "there are ~1000 people that live in California that have a website", or "90% of website owners have visited New York", or those kinds of things. Then say that an organization leaves the SaaS and wants their data removed. Am I to actually literally update the aggregated data with -1 user, or let's say -100 organization members, so it's calculations are based on 1 or 100 less users? That way, if 100 users left the SaaS and deleted their data, it would now maybe say "89% of website owners have visited New York", or however the aggregate was recomputed.
I ask this because, the way we are generating aggregate data currently is by querying over anonymized "data points". The location might be kept, or the fact they owned a website, or some financial data point, but the organization or user name (and database ID) is deleted from the anonymized data point. Then we do a SQL query on these points to compute the aggregated statistics. But the question is, if some organization or user asks to "remove their data", what are we to do with these "data points", since they are anonymized? We can't really delete them because they are anonymized, and we don't know where they came from (since org/user name is deleted on them, for example). So they ask to delete data, but we don't delete this data because we have no way to map it back to their org?
Is that acceptable? Or should we be keeping track of the org/user "under the hood", (not showing the personal information in the aggregate reports to customers though), and that way when they ask to delete their data, we can actually delete their data points from our analytics system?
The problem is, we want to build a data set of some kind, and so are keeping everything anonymized from the get go, but there is no way to actually know how to delete their data if they asked, but we did still technically have gained from their signing up and adding their data points originally. So I am not sure what to do. At a high level, what should you do for stringent "data privacy" laws (like GDPR, or the California data privacy one, or others). I don't need to know the exact specific law requirements, but just at a high level generally how it would work in this situation.
Note, when the user signs up, and they "agree to terms", the terms say we are going to collect their data and use it in these sorts of aggregated reports.
