A data-deletion workflow that satisfies the right to erasure

Lernfeld runs an online education platform in Berlin with about 90,000 users. Under European data-protection law, a user can ask for their personal data to be erased, and the company must do it within a month. Lernfeld has a backlog of 400 such requests it cannot fulfil properly, because user data is scattered: the main database, an analytics store, a search index, uploaded files, email logs and backups. Deleting the account row leaves copies everywhere, which is a breach waiting to happen.

The data-protection officer also points out that erasure is not unconditional. Some records must be kept, such as invoices needed for tax law, and those have to be retained and justified, not deleted. So the workflow has to know the difference between personal data that must go and records the company is legally required to keep.

You will build the deletion workflow against a seeded system with these stores. A verified request triggers a job that erases or anonymises personal data in each store, keeps the legally required records with a reason, and records proof of what was done to each store. The job must be safe to retry, because deletions across many systems fail halfway. Done looks like a request that erases a user from every store or anonymises them where a record must stay, a certificate listing what happened in each store, and a report the data-protection officer can show a regulator. Lernfeld signs off when a deleted user cannot be found anywhere they should be gone, and every retained record has a stated legal basis.