# Data Deletion Procedures

> **Acme Inc** — GDPR Art. 17 Right to Erasure Implementation Guide
>
> **Effective Date:** 2026-03-19
>
> Generated by [Codepliant](https://github.com/joechensmartz/codepliant)
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

## Related Documents

- DSAR Handling Guide (`DSAR_HANDLING_GUIDE.md`)
- Data Retention Policy (`DATA_RETENTION_POLICY.md`)
- Vendor Contacts Directory (`VENDOR_CONTACTS.md`)
- Data Dictionary (`DATA_DICTIONARY.md`)
- Privacy Policy (`PRIVACY_POLICY.md`)

---

## 1. Purpose

This document provides step-by-step data deletion procedures for every third-party service used by Acme Inc. When a data subject exercises their right to erasure under GDPR Article 17, CCPA/CPRA, or other applicable privacy laws, staff must follow these procedures to ensure complete deletion across all systems.

## 2. Legal Basis

Under GDPR Article 17, data subjects have the right to obtain erasure of their personal data when:

- The data is no longer necessary for its original purpose
- The data subject withdraws consent (where consent was the lawful basis)
- The data subject objects to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
- Erasure is required for compliance with a legal obligation

**Response deadline:** 1 month from receipt of request (extendable by 2 months for complex requests).

## 3. Pre-Deletion Checklist

Before executing deletion across services:

- [ ] Verify the data subject's identity
- [ ] Confirm the request is valid (not subject to Art. 17(3) exceptions)
- [ ] Document the request in the DSAR register
- [ ] Identify all systems containing the data subject's personal data
- [ ] Check for legal hold or regulatory retention obligations
- [ ] Export data if the subject also requested portability (Art. 20)
- [ ] Notify the DPO (dpo@acme-saas.com) before proceeding

## 4. Per-Service Deletion Procedures

### 4.1. Monitoring & Error Tracking

#### @sentry/node

**Data collected:** error data, stack traces, user context, device information, IP address

**Deletion Steps:**

1. Log in to the @sentry/node admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the @sentry/node documentation for API-based deletion options

**Retention Exceptions:**

- Check @sentry/node's DPA for mandatory retention periods
- Review @sentry/node's privacy policy for data retention disclosures

### 4.2. Authentication & Identity

#### @supabase/supabase-js

**Data collected:** email, password hash, session data, user metadata

**Deletion Steps:**

1. Log in to the @supabase/supabase-js admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the @supabase/supabase-js documentation for API-based deletion options

**Retention Exceptions:**

- Check @supabase/supabase-js's DPA for mandatory retention periods
- Review @supabase/supabase-js's privacy policy for data retention disclosures

### 4.3. AI Services

#### openai

**Data collected:** user prompts, conversation history, generated content

**API Deletion:**

`DELETE /v1/files/:id` — deletes uploaded files; conversation data managed via organization settings

**Admin Panel Steps:**

1. Navigate to Settings > Data Controls in the OpenAI Dashboard
2. Submit a data deletion request via the privacy portal

**Retention Exceptions:**

- ⚠ API usage logs retained for 30 days for abuse monitoring
- ⚠ Fine-tuned model weights may require separate deletion request

**Documentation:** https://platform.openai.com/docs/guides/production-best-practices

### 4.4. Analytics & Tracking

#### posthog

**Data collected:** user behavior, session recordings, feature flag usage, device information

**API Deletion:**

`DELETE /api/person/:id/` — deletes person and associated events

**Admin Panel Steps:**

1. Navigate to People in PostHog
2. Find the person by distinct_id or email
3. Click "Delete person" to remove all associated data

**Retention Exceptions:**

- ⚠ Events may take up to 24 hours to be fully purged from ClickHouse

**Documentation:** https://posthog.com/docs/privacy/data-deletion

### 4.5. Database

#### prisma

**Data collected:** user data as defined in schema

**Deletion Steps:**

1. Log in to the prisma admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the prisma documentation for API-based deletion options

**Retention Exceptions:**

- Check prisma's DPA for mandatory retention periods
- Review prisma's privacy policy for data retention disclosures

### 4.6. Email & Communication

#### resend

**Data collected:** email addresses, email content

**API Deletion:**

Contact support@resend.com for bulk data deletion

**Admin Panel Steps:**

1. Navigate to the Resend Dashboard
2. Delete individual email logs manually

**Retention Exceptions:**

- ⚠ Email delivery logs retained for 28 days

**Documentation:** https://resend.com/docs

### 4.7. Payment Processing

#### stripe

**Data collected:** payment information, billing address, email, transaction history

**API Deletion:**

`DELETE /v1/customers/:id` — deletes customer and associated payment data

**Admin Panel Steps:**

1. Navigate to Customers in the Stripe Dashboard
2. Select the customer record
3. Click "Delete customer" from the overflow menu

**Retention Exceptions:**

- ⚠ Transaction records retained for 7 years (financial regulation)
- ⚠ Dispute/chargeback records retained until resolution + 90 days

**Documentation:** https://stripe.com/docs/api/customers/delete

#### stripe-ios

**Data collected:** payment information, billing address, email, transaction history

**Deletion Steps:**

1. Log in to the stripe-ios admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the stripe-ios documentation for API-based deletion options

**Retention Exceptions:**

- Check stripe-ios's DPA for mandatory retention periods
- Review stripe-ios's privacy policy for data retention disclosures

## 5. Internal Database Deletion

In addition to third-party services, delete the data subject's records from internal databases:

```sql
-- Example deletion queries (adapt to your schema)
BEGIN TRANSACTION;

-- Delete user profile
DELETE FROM users WHERE email = :subject_email;

-- Delete associated records
DELETE FROM user_sessions WHERE user_id = :subject_id;
DELETE FROM user_preferences WHERE user_id = :subject_id;
DELETE FROM audit_logs WHERE user_id = :subject_id
  AND retention_required = false;

-- Anonymise records that must be retained
UPDATE orders SET customer_email = 'deleted@anonymised.local',
  customer_name = 'DELETED'
  WHERE customer_id = :subject_id;

COMMIT;
```

## 6. Verification & Documentation

After executing deletion across all systems:

| Step | Action | Completed |
|------|--------|-----------|
| 1 | Search for data subject in all services listed above | [ ] |
| 2 | Confirm zero results across all systems | [ ] |
| 3 | Document retention exceptions with legal justification | [ ] |
| 4 | Update the DSAR register with completion date | [ ] |
| 5 | Send confirmation to the data subject | [ ] |
| 6 | Notify the DPO (dpo@acme-saas.com) | [ ] |

## 7. Exceptions to Erasure (Art. 17(3))

The right to erasure does **not** apply when processing is necessary for:

| Exception | Example | Typical Retention |
|-----------|---------|-------------------|
| Freedom of expression and information | Published user reviews | Case-by-case |
| Legal obligation compliance | Tax records, financial regulations | 7-10 years |
| Public health reasons (Art. 9(2)(h)(i)) | Health data for public interest | Duration of need |
| Archiving in public interest | Research data, statistical purposes | Duration of study |
| Legal claims | Litigation hold, dispute evidence | Until resolution + limitation |

When an exception applies, document the specific legal basis and notify the data subject of the partial refusal with reasoning.

## 8. Backup & Replication Handling

Personal data may exist in backups and replicas:

- **Database backups:** Data will be overwritten as backup rotation cycles complete (typically 7-30 days)
- **Log aggregation:** Ensure log retention policies align with deletion obligations
- **CDN caches:** Purge cached content containing personal data
- **Search indices:** Trigger re-indexing to remove deleted records
- **Data warehouses:** Run deletion jobs against analytical data stores

Document the expected timeline for complete data purge from all backup systems in the DSAR response.

## 9. Escalation

| Scenario | Escalate To | Timeline |
|----------|-------------|----------|
| Unable to delete from a service | Jane Mueller (dpo@acme-saas.com) | Within 48 hours |
| Retention exception applies | Jane Mueller (dpo@acme-saas.com) | Before responding |
| Request involves special category data | DPO + Legal Counsel | Immediately |
| Third-party service unresponsive | DPO + Vendor Management | Within 72 hours |
| Deadline at risk (>25 days elapsed) | Jane Mueller (dpo@acme-saas.com) | Immediately |

---

*This document was auto-generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on code analysis. Adapt the deletion procedures to your actual database schema and service configurations. Review with your DPO and legal counsel before use.*
