Priya taps "Delete my account" in the Tiffin app. The obvious implementation is one statement:
DELETE FROM customers WHERE id = 81231;
That removes one copy. Her name, phone number and addresses also sit in read replicas, a Redis cache, the search index, three Kafka topics, the data lake's Parquet files, the warehouse, 35 days of database backups, application logs, the support tool, and a vector index built from her support chats. Every system that copied her data now holds part of her. This lesson is about finding every copy, deleting what can be deleted, making the rest unreadable, and keeping data in the country it's supposed to stay in.
Why it's not optional
Privacy laws give people a right to have their personal data erased:
- GDPR (EU), Article 17: the right to erasure. Article 12 says a request must be answered without undue delay and within one month, extendable by two more months for complex cases.
- India's DPDP Act 2023: section 12 lets a person ask for erasure, and section 8 also requires erasing data once its purpose is served or consent is withdrawn. The DPDP Rules notified in November 2025 phase in compliance over 18 months and set a maximum of 90 days to act on a request.
Both have exceptions where another law requires keeping data. Tiffin must keep invoices and payment records for tax and payments regulation, so "delete Priya" really means: delete what isn't needed, and strip personal details from what must be kept (the invoice keeps an amount and a date, not her address).