Yes, there are exceptions. For instance, data that is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims may be retained. Companies should communicate any such exceptions clearly to the individual making the request, providing the legal basis for retaining certain data.