Implementing Right to Erasure
Setting `is_deleted = true` is illegal under Article 17 if the purpose of processing has ended.
Soft vs. Hard Deletes
A soft delete is a UI illusion. The data remains in the table. You must implement a hard purge. If a user deletes their account, a message should be published to a Kafka/RabbitMQ queue (`user.deleted`). All microservices subscribe to this queue and purge related PII.
| System | Action Required | Retention Limit |
|---|---|---|
| Primary DB | DELETE FROM users WHERE id = X | Immediate (max 30 days) |
| S3 Backups | Lifecycle policies / Cryptographic erasure | Usually up to 90 days if documented |
| Financial Records | Anonymize user, retain ledger for IRS | 7 Years (Legal Obligation overrides Erasure) |
Tool: Soft Delete Cascade Simulator
Common Mistakes: Ignoring Backups
Restoring a SQL dump from 30 days ago might resurrect deleted users. You must run purge scripts against restored databases before bringing them into production.
FAQ
Can we keep data for ML training?
Only if explicitly consented to, or if fully, irreversibly anonymized (which is mathematically difficult).