Sure, but that time period is usually limited to 30 days, with an additional 30 day extension allowed if you contact the person and tell them you need more time.

You can’t just declare that it take years to delete data, GDPR sets reasonable limits on how long a company can delay true deletion.

Even if the company just issued you an invoice, that makes it obligated by law to hold onto your PII for the next 5 years - and GDPR of course has an exception for that.

Sure, but that data doesn’t fall under your right-to-be-forgotten, so any obligations that apply to the right-to-be-forgotten are irrelevant.

The GDPR gives limits on answering, I'm not sure it gives a limit on actually deleting the data everywhere.

Various types of data have various retention times for various reasons, some being legal reasons.

The GDPR says it's 30 days with a 2 month extension. This allows for having safe soft deletion and backup retention policies without running afoul of it.

Do you have a link for that?

https://gdpr.eu/article-12-how-controllers-should-provide-pe... section 3

Thanks!

The GDPR says data should be deleted "without undue delay", it doesn't give a hard deadline.