Keep records the law requires when someone asks to be erased

Some records must be kept even when the person they concern asks to be erased: invoices, receipts, accounting documents. A resource holding such records declares that a statute requires them and why. An erasure then completes everything else and keeps those records restricted until their period ends.

The problem it solves

An erasure request and a bookkeeping obligation collide on the same records. Refusing the whole erasure because some records must stay leaves the person’s other data in place for no reason. Deleting everything breaks the law on the records that must be kept. Keeping them silently gives the person no answer about what happened to their data and until when.

What it does

Declared, never inferred. A resource opts in with statutoryRetention and a rationale. It must be bound to the business-records retention class, so the period that ends the restriction is a declared number rather than an open-ended promise.

Everything else is erased as usual. A record kept under statutory retention never makes the erasure fail.

Kept records are restricted. Each one takes the resource’s declared erasure treatment, with personal details scrubbed where that says so, and is hidden from every ordinary read and write. It stays stored and is used for nothing else.

The answer names the ground and the end date. The erasure report lists each restricted record with its legal ground and the instant its period ends, kept apart from records an author simply chose to retain.

Then it goes. The scheduled retention job deletes each restricted record once its period has ended.

What you decide

Add statutoryRetention to the retentionPolicy of the resources that hold business records, bind them to the business-records class with the start point the law counts from, and declare that class’s period and reason in the retention schedule.

Selected from expense-receipts.resources-config.ts; the explanatory comments and the resource’s other settings are omitted.

retentionPolicy: {
  mode: ErasureRetentionMode.RETAIN_ONLY,
  statutoryRetention: {
    ground: StatutoryRetentionGround.LEGAL_OBLIGATION,
    rationale:
      'Accounting source documents (booking vouchers): HGB §257(1) no. 4 with AO §147(1) no. 4 in Germany, Code de commerce '
      + 'art. L123-22 in France. Kept for the declared BUSINESS_RECORDS period from the end of the calendar year of filing.',
  },
},
// …
retentionBinding: {
  retentionClass: DataRetentionClass.BUSINESS_RECORDS,
  startPoint: RetentionStartPoint.END_OF_CALENDAR_YEAR,
},

The expense receipt names its legal ground and the statutes behind it, and binds itself to the business-records class counted from the end of the calendar year it was filed in. The two belong together: the resource factory refuses a business-records binding without a statutory declaration, a statutory declaration bound to any other class, and an empty rationale. The receipt holds no personal data of its own, so its erasure treatment is RETAIN_ONLY: a restriction scrubs nothing.

Limits

The only ground is a legal obligation. Keeping data for possible legal claims is a legal hold, which concerns one case rather than every record of a kind.

A period counted from a record’s closure, such as the end of a matter or a case, cannot be declared yet, because a restricted record cannot be closed.