GDPR and hmrc regs

[Ivanzyt]

Just had a request from a customer to remove all their data under GDPR regs. The customer purchased from us online in July. Normally we keep financial records of sales including who to. We sell online to businesses and Joe public (retail). So we keep everything for 6 years + 1 to comply with hmrc regs.

Do I need to delete this customers records to comply with GDPR ? Or does the hmrc regs mean I can keep these as a justifiable reason? Hmrc does not require retail customer records are kept but our policy is 6 years+ 1 for all.

Anyone have any advice?

 

[Newchodge]

If hmrc doesn't require it you cannot use legislative requirement.

Why do you need to keep the records?

 

[JEREMY HAWKE]

You are only required to keep an invoice with the address and name of the customer for accounting purposes

 

[obscure]

You need to have a valid reason. "to comply with hmrc regs." isn't a valid reason if there is no such regulation in regard to retail customers.

Do you offer a warranty? Is there any statutory rights in regards to returns etc that would require you to keep records? In other words are there other valid reasons for keeping records.... if not why are you wanting to keep them?

 

[KAC]

Might be worth having a read here and here

 

[pentel]

I would keep them on file and use fulfilment of contract as the reason, keeping everything related to the contract for as long as necessary to have this info to hand to defend any claim from the customer.

 

[Paralabs]

I think we have a right to be forgotten. Do you think HMRC will oblige?

 

[EmployMe]

I think that you should explain how personal data is collected and used, and how consumers can view and request the removal of their data when appropriate.

 

[SteveHa]

You can anonymise the data.