Abstract
The article stipulates that a legal obligation in accordance with Article 17 (3) (b) GDPR exists, which justifies the processing of personal data by supervised institutions, for all documentation that is legally required to be retained. In particular, the rights of deletion set forth in the GDPR do not override the legal retention obligations. Where it is not possible to trace back the processing of personal data explicitly to legal retention rights, a contractual or even individual arrangement with the customer (obtaining a declaration of consent) is recommended. The data protection authority’s practice however also recognises the existence of an “legitimate interest” under certain circumstances and therefore the legality that personal data should also be retained, even when no explicit legal retention obligation exists.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
