A client asks you to delete everything. Usually you cannot, and that is allowed

Some of it, probably not all of it — and whatever you keep, you have to name the rule that lets you keep it.

The right to erasure is written about as though it were absolute. It is not. The ICO’s guidance on the right to erasure (checked 13 September 2026) sets out the situations where it does not apply, and two of them cover most of what a small service firm holds: where the processing is necessary to comply with a legal obligation, and where it is necessary for the establishment, exercise or defence of legal claims.

That second one is broader than people expect. A file you would need if the client sued you, or if you had to prove what you advised and when, sits inside it.

The exemption attaches to records, not to clients

This is where firms get it wrong in both directions. The exemption is not a blanket over the whole relationship. Your identity-verification file, your engagement letter, your advice notes — each may be covered by a different obligation, or by none. The client’s entry on your newsletter list is almost certainly covered by nothing. So the correct reply is usually a split one: here is what we have deleted, here is what we are keeping, and here is the rule that requires it.

“We keep everything for seven years” is a habit, not a legal basis. If you are relying on a retention duty, go to your regulator’s own current guidance — SRA, FCA, HMRC, the Money Laundering Regulations, whichever applies — and quote the instrument in your response. Periods change and differ by record type, so check them on the day you reply rather than repeating what someone told you in 2019.

And you cannot simply not respond. A refusal has to be reasoned and explained to the individual. Silence is the one option that is definitely wrong.

The test before you send: can you finish the sentence “we are keeping this because ___”? If you cannot, delete it.

This is general information, not legal advice. For a contested request, take advice on your own retention duties.