Hacker News Reader

point b of Article 17(1) of GDPR specifically says: (...) and where there is no other legal ground for the processing;

Compliance with tax & financial regulations counts as a "legal ground". But that doesn't mean companies can retain all of the email history.

View on HN

Exactly, you need to make this decision on a per-data item level. Financial transactions are at a different level than other customer interactions, and whatever the local laws for retention of accounting data state is what you will have to mark very explicitly as exempt.

This can get quite complicated, moreso if a company deals with both consumers and companies as customers.

Reply on news.ycombinator.com