Organizations can reject customer data removal requests when the data is:
Being used in legal claims or for establishing a legal defense.
Being used for exercising the right of freedom of information and expression.
Required to comply with legal obligations or rulings.
Being used for carrying out tasks in the public interest.
Necessary to be processed for public health purposes and serves the public interest.
Being processed for preventive or occupational medicine-related purposes.  (This is applicable only when a health professional who has the obligation of professional secrecy is processing the data).
Being used for scientific/historical research or statistical purposes in the public interest.