GDPR &amp; CCPA compliance involving terms of service violation
<p>If a user writes a comment on a website that gets flagged and removed+archived are we still obligated to delete the user content and/or the association of that comment with the person? According to GDPR and CCPA are we obligated to delete/disassociate user created content even if the user has violated the terms of service?</p>

<p>Wouldn't it be disadvantageous legally speaking if a user later on opened a law suit and we had no record of our interactions with that individual because we deleted their content in order to comply with these laws?</p>

<h2>Why do you think you are required to delete it?</h2>

<p>For example <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Article 7</a> of the GDPR has an exemption (among many others):</p>

<blockquote>
  <p>for the establishment, exercise or defence of legal claims.</p>
</blockquote>

gdpr terms-of-service eula ccpa