Steam processes your data under four legal bases which also determine how long your data is kept, who can access it, and what rights you have to control it. The policy references a separate section 6 for full details on user rights including access, deletion, and portability.
Steam's data retention and your deletion rights are tied to the legal basis for each processing activity, meaning some of your personal data may be retained indefinitely for legal compliance or legitimate business purposes even after you request deletion.
Cross-platform context
See how other platforms handle User Rights and Data Deletion and similar clauses.
Compare across platforms →Your ability to delete your data, access it, or port it to another service depends on which legal basis Steam invokes for each type of processing — and if Steam relies on 'legitimate interests' or 'legal obligation,' your deletion or objection rights may be limited.
REGULATORY FRAMEWORK: GDPR Arts. 15-22 establish the full suite of data subject rights: access (Art. 15), rectification (Art. 16), erasure/right to be forgotten (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and rights related to automated decision-making (Art. 22). CCPA §§1798.100–1798.125 provide parallel rights for California residents including the right to know, delete, correct, and opt out. Valve must respond to GDPR requests within 30 days (extendable to 3 months) and CCPA requests within 45 days (extendable to 90 days).
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.