@MichaelLammer @MalwareJake GDPR takes a similar view - if the data gets deleted, that's still a breach because you lost control of it. Which, tbh, is perfectly sane, if a bit inconvenient for whoever has to report it