Can a company keep my personal data after I delete my account?
"Delete" is a right, not a guarantee — and both GDPR and CCPA build real exceptions into it.
Sometimes, yes, and it's legal. Both the EU/UK's GDPR right to erasure (Article 17) and California's CCPA deletion right come with specific, named exceptions built into the law itself — not loopholes companies invented. Common legitimate reasons include an active legal obligation (tax records, for example), fraud and security investigations, defending against a legal claim, and completing a transaction you already started. Deleting your account triggers a real right, but it isn't an instruction that erases every trace of you everywhere, instantly.
The GDPR exceptions, specifically
Article 17(3) lists when a company can refuse or limit an erasure request, even when you've asked directly:
- Compliance with a legal obligation requiring the processing (e.g., financial record-keeping laws)
- Exercising the right of freedom of expression and information
- Reasons of public interest in the area of public health
- Archiving purposes in the public interest, scientific or historical research, or statistical purposes
- The establishment, exercise, or defense of legal claims
A company relying on one of these has to tell you which one applies — a vague "we can't delete that" isn't a sufficient answer under the law.
The CCPA exceptions, specifically
California's law lists a similar, separately-worded set of exceptions, including data a business needs to:
- Complete the transaction for which the data was collected, provide a good or service you requested, or fulfil the terms of a written warranty or product recall
- Detect security incidents, protect against fraud, or debug errors
- Comply with a legal obligation
- Enable solely internal uses that are reasonably aligned with your expectations as a customer
What "deleted" usually actually means in practice
| What happens | Is this normal? |
|---|---|
| Your profile disappears immediately, but billing/transaction records are kept for a set retention period | Yes — this is the legal-obligation exception at work, typically tied to tax or accounting law retention periods |
| Your data is removed from active systems but persists briefly in backups until they're overwritten | Yes — GDPR guidance generally accepts this as long as backups aren't actively used and are purged on a normal cycle |
| The company simply says no with no explanation of which exception applies | No — this isn't a valid response under either law |
| Data is kept indefinitely "in case we need it later" with no specific legal basis named | No — this doesn't fit any of the recognized exceptions |
What to do if you think a refusal isn't legitimate
- Ask the company in writing exactly which specific exception they're relying on — they're required to tell you, not just refuse generically.
- If the explanation doesn't map to a real exception listed above, request it be escalated internally, citing GDPR Article 17 or the CCPA specifically.
- In the EU/UK, escalate to your national data protection authority (the ICO in the UK) if the company won't engage or the explanation seems invalid.
- In California, complaints can be directed to the California Privacy Protection Agency.
- Keep a written record of your original deletion request and every response — this matters if you need to escalate.
Related questions
Official sources
Deletion request refused with no real explanation?
Use Kibbo's Privacy & Data tools to draft a formal erasure request citing the exact legal right that applies to you.
Explore Privacy & Data tools →