Under the GPDR, lack of deletion is also a risk.