Exceptions to Deletion

When you receive a Request to Delete, your business may still retain personal information if it is needed for one or more of the reasons below. We ask your business to identify which reasons apply because it is required to disclose this information to consumers who make a Request to Delete.

If you retain personal information for one of these reasons, it’s important to note that your business may not use that information for any other purpose.

1. To Complete a Transaction with the Consumer

Your business may retain personal information if it is necessary to provide a good or service requested by the consumer. For example, if a customer purchased one of your products online, you may need to retain their payment details, contact information, and shipping address, at least until the product has been received.

2. To Fulfill a Warranty or Effectuate a Recall

Some businesses offer warranties or may need to issue a recall on their products. To the extent a consumer's personal information is necessary for those purposes, your business may retain that data.

3. To Perform a Contract with the Consumer

If your business has entered into a contract with a consumer, you may retain any personal information that is necessary to fulfill the terms of that contract. For example, if a business has a coffee subscription service where it sends a bag of coffee to customers once a month, the business may keep a customer’s contact information to the extent that it is necessary to keep sending them coffee.

4. To Detect and Prevent Security Threats and Fraud

You may retain personal information when it is necessary to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity. This could range from data processed by cybersecurity providers to confirmation of delivery for an online order.

5. Debugging

Your business may retain personal information to identify and repair technical errors that impair existing or intended functionality. For example, this may include logs of user activity on your business’s website or mobile app.

5. To Exercise Free Speech

Personal information may be retained to ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law. This probably will not apply to most businesses, but is relevant to businesses such as social media platforms.

6. To Comply with an Investigation or Court Order

Your business may retain personal information that is necessary to comply with court orders and investigations by government authorities. This is usually specific to the situation, and you should consult with your business’s attorney if you think it might be the case.

7. To Comply with a Legal Obligation

Beyond complying with court orders and investigations, your business may need to retain personal information to comply with various other legal obligations. A wide variety of information could be affected by legal obligations, from tax records to HR data.

8. To Exercise or Defend a Legal Claim

You may retain personal information to investigate, establish, exercise, prepare for, or defend legal claims (i.e., lawsuits). If you think this may be the case, you should consult with your attorney.

9. To Engage in Scientific Research

Personal information may be retained to engage in scientific, historical, or statistical research in the public interest, when the business’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent. This does not apply to many businesses.

10. Solely Internal Uses

Your business may retain personal information to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business. For example, records of a customer’s purchases may be retained as part of general recordkeeping of products sold, but they can’t be used for other purposes like sending promotional emails.

This content is provided for general informational purposes only and does not constitute legal advice. This content is not a substitute for obtaining legal advice from a licensed attorney. The information on this page may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.