Do you need to remove a customer&#39;s data for GDPR or the like, if that data has been anonymized and used as part of an aggregate?
<p>Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users &quot;there are ~1000 people that live in California that have a website&quot;, or &quot;90% of website owners have visited New York&quot;, or those kinds of things. Then say that an organization leaves the SaaS and wants their data removed. Am I to actually literally update the aggregated data with -1 user, or let's say -100 organization members, so it's calculations are based on 1 or 100 less users? That way, if 100 users left the SaaS and deleted their data, it would now maybe say &quot;89% of website owners have visited New York&quot;, or however the aggregate was recomputed.</p>
<p>I ask this because, the way we are generating aggregate data currently is by querying over <em>anonymized</em> &quot;data points&quot;. The location might be kept, or the fact they owned a website, or some financial data point, but the organization or user name (and database ID) is deleted from the anonymized data point. Then we do a SQL query on these points to compute the aggregated statistics. But the question is, if some organization or user asks to &quot;remove their data&quot;, what are we to do with these &quot;data points&quot;, since they are anonymized? We can't really delete them because they are anonymized, and we don't know where they came from (since org/user name is deleted on them, for example). So they ask to delete data, but we don't delete this data because we have no way to map it back to their org?</p>
<p>Is that acceptable? Or should we be keeping track of the org/user &quot;under the hood&quot;, (not showing the personal information in the aggregate reports to customers though), and that way when they ask to delete their data, we can actually delete their data points from our analytics system?</p>
<p>The problem is, we want to build a data set of some kind, and so are keeping everything anonymized from the get go, but there is no way to actually know how to delete their data if they asked, but we did still technically have gained from their signing up and adding their data points originally. So I am not sure what to do. At a high level, what should you do for stringent &quot;data privacy&quot; laws (like GDPR, or the California data privacy one, or others). I don't need to know the exact specific law requirements, but just at a high level generally how it would work in this situation.</p>
<p>Note, when the user signs up, and they &quot;agree to terms&quot;, the terms say we are going to collect their data and use it in these sorts of aggregated reports.</p>

<p>Among other things, GDPR regulates what you may do with the data <strong>within</strong> your systems. You can use it for the contracted purpose, or in accordance to law, or with informed and revokable consent, or for some other enumerated purposes. Even with consent, you have to take security measures to avoid the misuse of the data.</p>
<p>Remember the software shrink-wrap licenses? &quot;By opening the package, you agree to the terms inside.&quot; GDPR makes the equivalent in the cloud world impossible. You have to document exactly what you do with the data, and for any use that is not necessary to perform the service the customer can opt out.</p>
<p>In the scenario you describe, it is possible that you are not the data <em>controller</em> under GDPR but the data <em>processor</em>, and that you have a duty to keep the data from separate <em>controllers</em> apart. And delete any batch at the end of contract.</p>
<p>If you want to do this professionally, you need to consult a lawyer for your specific plans.</p>

gdpr privacy data-protection