Is a business required to delete only 12 months of consumer information in response to a request to be forgotten?

No.

Unlike a request for access,¹a business’s deletion obligation extends to all data held by the business regarding a consumer, unless an exception applies, irrespective of when that data was collected, generated or processed.  Neither the statutory text nor the regulations establish a “lookback period” for requests for deletion.  That said, a business is not obligated to delete consumer information that it is required to retain to comply with a legal obligation.²As a consequence, a business may be required to retain data for a period of time under applicable law. 

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide.

1. CCPA, Section 1798.135(a)(2).

2. CCPA. Section 1798.105(d)(8).