Data Deletion

Data deletion removes information within a defined scope. A deletion request needs a completion rule: which copies, interfaces, and external processors require action, and which approved exceptions remain?

One successful operation is not the whole request

Removing a database row can leave an export, search passage, embedding, cache entry, or log. Track destinations separately and retry failures. If an index deletion fails, restrict prohibited serving while the failure is repaired rather than announcing that every copy is gone.

Deletion evidence should identify the action and outcome without unnecessarily copying the deleted payload into the evidence.

Recovery can reintroduce a record

Backups may expire on a separate approved schedule. Before restored data becomes available, apply deletion records or equivalent controls. A query returning no rows proves only what that interface returned.

If records trained a model, deleting the training file does not prove removal of their influence from model parameters. That path requires a separate assessment and plan. Record actual completion and remaining limitations.

Reference: NIST Privacy Framework.