A former customer asked us to delete their personal data. We had a documented process for this and I expected it to take an afternoon. It took eleven days, involved six teams, and taught us more about our own systems than the previous year of architecture reviews.
The core record was easy. It lived in the customer platform, the process worked, the row was removed. The rest of the estate was the education.
The data warehouse held a copy loaded nightly for four years, along with derived tables that had been built from it and that nobody could confidently trace back. The support tool held the customer's name, address and two attachments inside ticket threads written by humans in free text. An older billing system, still running because two contracts have not expired, held a full record and had no deletion function at all, only a status flag. Three teams held extracts in spreadsheets on shared drives, taken legitimately for a migration in 2022. And our backups, quite properly, held everything, which raised a policy question about what deletion even means when your restore window is thirteen months.
None of this was negligence. Every copy had been created for a defensible reason by someone doing their job. What we lacked was any record that the copies existed, or any way to answer the question of where a given customer's data lives without asking people to search their own systems and trust the answer.
The work that followed was less about privacy law than about basic hygiene. We built a data inventory that lists, per system, what personal data it holds, where it came from, who owns it and how long it is kept. Extracts to spreadsheets now require a stated purpose and an expiry. The legacy billing system got a documented, tested manual procedure and a retirement date, because a status flag is not deletion. And our deletion policy now states plainly how backups are handled and within what period a restored copy is re-processed, so the answer is written down rather than improvised.
A deletion request is an unusually honest audit. It does not care about your architecture diagram; it asks where the data actually is, and it will not accept a diagram as an answer.
– Serguey Shinder
Top comments (0)