You submitted a GDPR erasure request. The company replied with a form letter citing "legitimate interests" or "legal obligation." Is that refusal valid? Often, it is not — and companies know you are unlikely to push back. Here is how to challenge it.
GDPR Article 17 gives you the right to have your personal data erased when: GDPR Art.17
| What they say | Is it valid? |
|---|---|
| "We have a legal obligation to retain your data" (e.g. tax records, regulated financial data) | Potentially valid — but only for the specific data subject to the legal obligation, for the specific retention period required by law. They cannot use this to retain everything indefinitely. |
| "We have a legitimate interest in retaining your data" | Usually invalid — legitimate interests must be specific, documented, and proportionate. A vague claim of "legitimate interests" without specifying what those interests are and why they override your rights is not sufficient. |
| "We need it for the performance of a contract" | Invalid after the contract ends — once the relationship is over, this legal basis falls away. They can retain data needed for legal disputes but not operational data indefinitely. |
| "Erasure is technically impossible" | Almost never valid — they must make reasonable efforts to erase data. Backups are an accepted exception for a limited period, but active systems must be updated. |
Ask them to specify:
"Please confirm which specific exception under GDPR Article 17(3) you are relying on, which specific categories of data this applies to, and the duration of retention. A general reference to 'legitimate interests' is not a sufficient response under Article 12(3)."
Under GDPR Article 12(3), they must respond within one month. GDPR Art.12
If the company does not respond adequately, file a complaint with your national data protection authority. It is free. The company faces investigation and potential fines.
Fix AI has a GDPR erasure dispute case where DataVault refuses your deletion request citing "legitimate interests." Practice the exact arguments before you need them for real.
Practice This Dispute Free →