GDPR and withdrawal: what to do with the form data?

We talk about the button, the acknowledgement, the proof. We often forget that all of this handles personal data: surname, first name, email, order reference, IP address, timestamp. As soon as a consumer fills in the withdrawal form, you process this data, and the GDPR applies. Here are the few points to frame in order to be compliant on both sides, consumer law and data protection.

A legal basis that goes without saying

The first GDPR question is always: on what ground do you process this data? For withdrawal, the answer is comfortable. The processing is necessary for compliance with a legal obligation to which you are subject (receiving and handling the request under the Consumer Rights Directive (2011/83/EU) and the button obligation of Directive (EU) 2023/2673) and for the performance of the contract. You therefore do not need the customer's consent to process their request: it falls under the performance of your obligations.

This does not exempt you from informing the consumer of the use of their data, ideally at the point of the form and in your privacy policy.

Collect only what is necessary

The minimisation principle requires you to ask only for the data useful to the purpose. To identify a withdrawal request, you need little: the identity of the requester, something to attach the request to the contract (an order number, for example), and a means of contacting them back for the acknowledgement.

Taking advantage of the form to collect a phone number, a date of birth or marketing information would be disproportionate. A withdrawal form is not a sign-up form: each field must be justified by the purpose.

The real question: how long to keep it?

This is where the two logics seem to oppose one another. The GDPR pushes towards not keeping data longer than necessary. Consumer law, for its part, asks you to be able to prove that the request was indeed received and handled, sometimes more than a year later.

There is no contradiction, provided you reason by purpose and by duration:

• During the handling: you keep the data for the time needed to handle the request and carry out the refund (14 days, plus the logistical time).
• For the purpose of proof: you then keep the record of the request for the applicable limitation period under your national law, so as to be able to produce it in the event of a dispute or an inspection. National limitation periods for commercial matters typically run to several years.
• Afterwards: the data that no longer serves any of these purposes must be deleted or archived in a restricted way.

Keeping the proof is therefore not a breach of the GDPR: it is a retention justified by a legitimate purpose, for a determined and reasoned duration.

Right to erasure and proof: which prevails?

A customer can request the erasure of their data. But this right is not absolute: it gives way before a legal obligation to retain and before the necessity of establishing, exercising or defending legal claims. Concretely, you can refuse to erase the proof of a withdrawal as long as it remains useful to establish your obligations, explaining this to the requester.

The challenge is to hold both ends: honouring GDPR rights for what no longer has evidential use, and keeping, in a framed way, what protects you.

Security and hosting

Withdrawal data is ordinary personal data, but it deserves the same care as the rest: restricted access, secure transmission, controlled hosting. Hosting within the European Union simplifies compliance by avoiding the question of transfers outside the EU. It is a criterion to check if you rely on an external tool to manage the mechanism.

The right reflex: a mechanism that thinks about both compliances

Many home-made set-ups handle consumer law and forget the GDPR, or the reverse. The ideal mechanism handles both in one block: minimal collection, clear legal basis, acknowledgement on a durable medium, timestamped proof kept for a justified duration, and the ability to export or purge the data. The proof you keep must be at once legally solid and clean from a data point of view.

For the evidential dimension of this retention, see our file on the evidential value of withdrawal proof. And to quickly check your overall exposure, test whether you are concerned.