Question

A customer in the EU submits a formal request asking your company to delete all personal data it holds about them. The marketing team says the customer's records are still useful for churn analysis and wants to keep them. As the data analyst supporting governance, what is the appropriate action under GDPR?

Accepted Answer

Honor the request by deleting or fully anonymizing the customer's personal data, unless a lawful basis requires retention

Answer

Keep the records but flag them as 'do not contact' so marketing can still use them for analysis

Answer

Retain the data indefinitely because aggregated analytics benefit the business and outweigh the individual request

Answer

Mask only the customer's name while leaving email, address, and purchase history intact