Security playbook · AI Employee: Sig

Privacy / Data Deletion

DSAR completed within SLA (30 days GDPR / 45 CCPA)

Install this playbookBack to marketplace
The problem

Privacy data-subject requests — GDPR erasure, CCPA delete, Brazilian LGPD deletion — arrive by web form, email, and support ticket. The response requires deleting the subject's data from every system: production database, backups, analytics warehouses, marketing tools, third-party processors, log stores. Missing one system voids the compliance. Doing it manually takes 3-8 weeks per request and scales linearly with request volume.

At a glance
Trigger
Form (DSAR)
Approvals
Legal review for edge cases
What it does
Writes to your systems
Systems
Data lake · CRM · Marketing · Product DB
How it feels in production

An hour-by-hour walkthrough.

A DSAR arrives via the privacy web form: "Please delete all data related to my account, email [email protected]." Lex picks up the request, opens a case, verifies the requester (email verification link + identity check for regulated jurisdictions), and starts orchestration. For each system on the deletion inventory (kept as a living map, updated when new systems are onboarded), Lex determines: has the subject's data ever landed here, what's the deletion mechanism (soft-delete + anonymise, hard-delete, backup-purge-on-cycle), what's the retention exception (invoicing under active dispute must be retained, per policy). Deletion plan: - Production DB (Postgres): DELETE user + cascade + anonymise foreign-key references - Analytics warehouse (Snowflake): DELETE + tombstone - Marketing (HubSpot, Marketo): API delete + unsubscribe from lists - Customer support (Zendesk): pseudonymise closed tickets + delete open PII - Third-party processors (Stripe, Segment, Iterable): API delete with confirmation - Log stores (Datadog, CloudWatch): PII-scrubber pass + retention-cycle timeout - Backups: mark subject in the retention exception; ensure re-hydration would trigger re-delete Legal reviews the plan. Approves (or flags exceptions — e.g., active fraud investigation warrants retention). Lex executes; each system returns a deletion confirmation; timeline logged; certificate of deletion generated for the subject. Regulatory clock (30 days GDPR, 45 days CCPA) tracked to completion.
How it works

Step by step.

  1. 01

    Intake + verify + open case

    Web form / email / support ticket surface. Verify requester identity per policy (email verification, ID check for regulated jurisdictions). Open case with unique ID, jurisdiction, applicable regulation, deadline.

    Privacy web form · Email · Zendesk · Case management
  2. 02

    Inventory subject presence across every system

    Query the deletion inventory: which systems could hold this subject. For each, check presence. Some systems (production DB) always checked; others (marketing) only if the subject was ever in scope.

    System inventory · Query orchestration · PII map
  3. 03

    Draft the deletion plan with per-system mechanism + exceptions

    Each system: presence confirmed, deletion mechanism, retention exceptions applicable (invoicing, active dispute, fraud investigation). Plan surfaces exceptions for legal decision.

    Deletion plan engine · Legal policy · Retention rules
  4. 04

    Legal approval + execute atomically

    Legal reviews exceptions + approves plan. Execute across every system with confirmations. Failed deletions retry; unrecoverable failures escalate to security engineering for manual resolution.

    Legal approval · API executions · SQL executions · Verification
  5. 05

    Certificate + regulatory clock closure

    Certificate of deletion issued to subject listing every system and confirmation. Regulatory-clock closure record filed with timestamp + evidence. Deletion inventory audit trail retained for regulatory response.

    Email · Case management · Audit log
Systems and wiring

What you connect to make this run.

Production databases · Data warehouses

read+write

SQL / API delete per schema. Foreign-key cascade + anonymisation of dependent records that can't be deleted. Verification query confirms removal.

HubSpot · Marketo · Segment · Iterable

read+write

Marketing + product analytics platforms. API delete per each. Some (Segment) fan out to downstream destinations automatically; others require per-destination delete.

Backups · Object storage

read+write

Backups can't be selectively deleted mid-cycle in most cases. Mark subject in retention exception; verify next backup rotation completes the removal. Track the deletion-complete date past backup cycle.

Legal policy · Retention rules

read

Retention exceptions per data class. Legal-hold trumps deletion; active fraud investigation retains; tax-relevant records held per statutory period. Rules surface exceptions during plan drafting.

What changes

Before and after, honestly.

Time from DSAR receipt to certificate issued
Before
3-8 weeks
After
2-5 business days
% of systems included in deletion (compliance)
Before
60-85%
After
99%+ (inventory-driven, verified)
Regulatory deadline breaches
Before
5-20% of requests
After
Zero (deadline tracked as first-class)
Privacy team hours per DSAR
Before
8-24 hours
After
1-2 hours (review + exceptions only)
Related

Playbooks that pair with this one.

Legal

Data Subject Request Routing

Intake + routing sits upstream; this playbook executes the deletion path.

Legal

Privacy Review for New Features

New features that store PII must be added to the deletion inventory before launch.

Frequently asked

Answers about this playbook.

What if the subject is a paying customer and deletion would break their service?

Some jurisdictions allow the controller to refuse or partially fulfil where deletion would break the contract. Lex surfaces the trade-off to legal + the subject; the subject can amend the request (delete profile but retain billing for service continuity).

How does it handle data in third-party processors we don't fully control?

Every subprocessor is required by DPA to support deletion. Lex sends deletion requests with tracked confirmations. Failure to confirm within SLA escalates to legal + vendor management.

What about historical exports (CSV files someone downloaded)?

Corporate-controlled endpoints scanned for exports containing the subject's data. Personal-copy exports (rare) require attestation from the holder. Full audit trail of all downstream exports.

How does deletion interact with legal hold?

Legal hold trumps deletion — subject on litigation hold cannot be deleted until hold released. Case pauses; certificate of deletion cannot be issued. Regulator informed per applicable exception.

Can subjects request specific-data deletion rather than everything?

Yes — partial deletion supported. Subject specifies (marketing profile, not billing history). Plan generated for the specified scope only.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks