A message arrives from someone in the legal team you have never spoken to. A customer has asked for all of their data to be deleted, and before the company replies, the lawyer wants to understand exactly what happens when your system deletes an account. Could you explain it in writing by Thursday?
Your instinct may be to reassure. We delete it, it is gone, nothing to worry about. Resist that. The lawyer is not asking for comfort. They are about to make a statement on the company's behalf, and whatever you write may end up repeated to a customer or a regulator. They need the truth, exactly as it is, including the uncomfortable parts.
Before you write anything, go and check. Do not describe the system from memory. Read the deletion code, look at what actually runs, and ask the people who own the parts you do not.
Then follow the data everywhere it goes. The main database is the easy part. What about backups, and how long are they kept? Logs that include email addresses? The analytics platform, the search index, the support tool, the copy someone exported for a report last year? Most systems keep traces in places nobody thinks of when they say deleted.
Be precise with words. Deleted, anonymised, hidden and marked inactive mean different things, and a lawyer will read them literally. If a record is flagged rather than removed, say so. If something is removed after thirty days, say thirty days, not soon.
Separate what you know from what you believe. A short line saying I have checked this, and another saying I think this is true but have not confirmed it, is far more useful than a confident paragraph that turns out to be partly wrong.
Keep it plain. Explain technical terms the first time you use them, and use a short list of where the data lives and what happens to it in each place. Offer a quick call if anything is unclear, because they may not know which questions to ask.
If you find a gap, say so. Telling a lawyer that backups keep the data for ninety days is much better than them finding out later. You are not getting anyone in trouble. You are helping the company say something true.
– Asael Shinder
Top comments (0)