There's a whole list of exceptions included in both GDPR and this law. For example, a business does not need to delete information when it is required to: "Complete the transaction for which the personal information was collected, provide a good or service requested by the consumer, or reasonably anticipated within the context of a business’s ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer"