> Acme Inc — GDPR Art. 17 Right to Erasure Implementation Guide

>

> Effective Date: 2026-03-19

>

> Generated by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Related Documents

- DSAR Handling Guide (`DSARHANDLINGGUIDE.md`)
- Data Retention Policy (`DATARETENTIONPOLICY.md`)
- Vendor Contacts Directory (`VENDOR_CONTACTS.md`)
- Data Dictionary (`DATA_DICTIONARY.md`)
- Privacy Policy (`PRIVACY_POLICY.md`)

## 1. Purpose

This document provides step-by-step data deletion procedures for every third-party service used by Acme Inc. When a data subject exercises their right to erasure under GDPR Article 17, CCPA/CPRA, or other applicable privacy laws, staff must follow these procedures to ensure complete deletion across all systems.

## 2. Legal Basis

Under GDPR Article 17, data subjects have the right to obtain erasure of their personal data when:

- The data is no longer necessary for its original purpose
- The data subject withdraws consent (where consent was the lawful basis)
- The data subject objects to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
- Erasure is required for compliance with a legal obligation

Response deadline: 1 month from receipt of request (extendable by 2 months for complex requests).

## 3. Pre-Deletion Checklist

Before executing deletion across services:

- Verify the data subject's identity
- Confirm the request is valid (not subject to Art. 17(3) exceptions)
- Document the request in the DSAR register
- Identify all systems containing the data subject's personal data
- Check for legal hold or regulatory retention obligations
- Export data if the subject also requested portability (Art. 20)
- Notify the DPO (dpo@acme-saas.com) before proceeding

## 4. Per-Service Deletion Procedures

### 4.1. Monitoring & Error Tracking

#### @sentry/node

Data collected: error data, stack traces, user context, device information, IP address

Deletion Steps:

1. Log in to the @sentry/node admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the @sentry/node documentation for API-based deletion options

Retention Exceptions:

- Check @sentry/node's DPA for mandatory retention periods
- Review @sentry/node's privacy policy for data retention disclosures

### 4.2. Authentication & Identity

#### @supabase/supabase-js

Data collected: email, password hash, session data, user metadata

Deletion Steps:

1. Log in to the @supabase/supabase-js admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the @supabase/supabase-js documentation for API-based deletion options

Retention Exceptions:

- Check @supabase/supabase-js's DPA for mandatory retention periods
- Review @supabase/supabase-js's privacy policy for data retention disclosures

### 4.3. AI Services

#### openai

Data collected: user prompts, conversation history, generated content

API Deletion:

`DELETE /v1/files/:id` — deletes uploaded files; conversation data managed via organization settings

Admin Panel Steps:

1. Navigate to Settings > Data Controls in the OpenAI Dashboard
2. Submit a data deletion request via the privacy portal

Retention Exceptions:

- ⚠ API usage logs retained for 30 days for abuse monitoring
- ⚠ Fine-tuned model weights may require separate deletion request

Documentation: https://platform.openai.com/docs/guides/production-best-practices

### 4.4. Analytics & Tracking

#### posthog

Data collected: user behavior, session recordings, feature flag usage, device information

API Deletion:

`DELETE /api/person/:id/` — deletes person and associated events

Admin Panel Steps:

1. Navigate to People in PostHog
2. Find the person by distinct_id or email
3. Click "Delete person" to remove all associated data

Retention Exceptions:

- ⚠ Events may take up to 24 hours to be fully purged from ClickHouse

Documentation: https://posthog.com/docs/privacy/data-deletion

### 4.5. Database

#### prisma

Data collected: user data as defined in schema

Deletion Steps:

1. Log in to the prisma admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the prisma documentation for API-based deletion options

Retention Exceptions:

- Check prisma's DPA for mandatory retention periods
- Review prisma's privacy policy for data retention disclosures

### 4.6. Email & Communication

#### resend

Data collected: email addresses, email content

API Deletion:

Contact support@resend.com for bulk data deletion

Admin Panel Steps:

1. Navigate to the Resend Dashboard
2. Delete individual email logs manually

Retention Exceptions:

- ⚠ Email delivery logs retained for 28 days

Documentation: https://resend.com/docs

### 4.7. Payment Processing

#### stripe

Data collected: payment information, billing address, email, transaction history

API Deletion:

`DELETE /v1/customers/:id` — deletes customer and associated payment data

Admin Panel Steps:

1. Navigate to Customers in the Stripe Dashboard
2. Select the customer record
3. Click "Delete customer" from the overflow menu

Retention Exceptions:

- ⚠ Transaction records retained for 7 years (financial regulation)
- ⚠ Dispute/chargeback records retained until resolution + 90 days

Documentation: https://stripe.com/docs/api/customers/delete

#### stripe-ios

Data collected: payment information, billing address, email, transaction history

Deletion Steps:

1. Log in to the stripe-ios admin dashboard
2. Locate the user/data record using the data subject's identifier
3. Delete all personal data associated with the identifier
4. Verify deletion by searching for the identifier again
5. Check the stripe-ios documentation for API-based deletion options

Retention Exceptions:

- Check stripe-ios's DPA for mandatory retention periods
- Review stripe-ios's privacy policy for data retention disclosures

## 5. Internal Database Deletion

In addition to third-party services, delete the data subject's records from internal databases:

    -- Example deletion queries (adapt to your schema)
    BEGIN TRANSACTION;

    -- Delete user profile
    DELETE FROM users WHERE email = :subject_email;

    -- Delete associated records
    DELETE FROM user_sessions WHERE user_id = :subject_id;
    DELETE FROM user_preferences WHERE user_id = :subject_id;
    DELETE FROM audit_logs WHERE user_id = :subject_id
      AND retention_required = false;

    -- Anonymise records that must be retained
    UPDATE orders SET customer_email = 'deleted@anonymised.local',
      customer_name = 'DELETED'
      WHERE customer_id = :subject_id;

    COMMIT;

## 6. Verification & Documentation

After executing deletion across all systems:

Step | Action | Completed
--- | --- | ---
1 | Search for data subject in all services listed above | [ ]
2 | Confirm zero results across all systems | [ ]
3 | Document retention exceptions with legal justification | [ ]
4 | Update the DSAR register with completion date | [ ]
5 | Send confirmation to the data subject | [ ]
6 | Notify the DPO (dpo@acme-saas.com) | [ ]

## 7. Exceptions to Erasure (Art. 17(3))

The right to erasure does not apply when processing is necessary for:

Exception | Example | Typical Retention
--- | --- | ---
Freedom of expression and information | Published user reviews | Case-by-case
Legal obligation compliance | Tax records, financial regulations | 7-10 years
Public health reasons (Art. 9(2)(h)(i)) | Health data for public interest | Duration of need
Archiving in public interest | Research data, statistical purposes | Duration of study
Legal claims | Litigation hold, dispute evidence | Until resolution + limitation

When an exception applies, document the specific legal basis and notify the data subject of the partial refusal with reasoning.

## 8. Backup & Replication Handling

Personal data may exist in backups and replicas:

- Database backups: Data will be overwritten as backup rotation cycles complete (typically 7-30 days)
- Log aggregation: Ensure log retention policies align with deletion obligations
- CDN caches: Purge cached content containing personal data
- Search indices: Trigger re-indexing to remove deleted records
- Data warehouses: Run deletion jobs against analytical data stores

Document the expected timeline for complete data purge from all backup systems in the DSAR response.

## 9. Escalation

Scenario | Escalate To | Timeline
--- | --- | ---
Unable to delete from a service | Jane Mueller (dpo@acme-saas.com) | Within 48 hours
Retention exception applies | Jane Mueller (dpo@acme-saas.com) | Before responding
Request involves special category data | DPO + Legal Counsel | Immediately
Third-party service unresponsive | DPO + Vendor Management | Within 72 hours
Deadline at risk (>25 days elapsed) | Jane Mueller (dpo@acme-saas.com) | Immediately

This document was auto-generated by Codepliant based on code analysis. Adapt the deletion procedures to your actual database schema and service configurations. Review with your DPO and legal counsel before use.