@cazabon @beyondmachines1 For his European operations, I strongly suspect that Santa is operating under GDPR article 6 section 1 paragraphs (b) necessary for performance of contract, and/or (d) necessary to protect vital interests of data subject, and/or (e) necessary for performance of task carried out in public interest.
He also has plenty of workers with whom complaints can be lodged or additional information filed. Surely they can handle a deletion request too.
@mkj let's not forget Article 8, and whether the parents have given their consent for Santa to process the data of underage children...