How To Implement Right To Be Forgotten In Your Application

The right to be forgotten, formally established under GDPR Article 17, gives individuals the right to request deletion of their personal data. For developers building applications that store user data, implementing this capability is not just a legal requirement—it is a fundamental aspect of user privacy and trust. This guide provides practical patterns for implementing data deletion across common database systems.

Understanding the Scope of Data Deletion

Before writing any deletion code, you must identify all locations where user data exists. A complete implementation requires removing data from:

Primary user tables
Related records in dependent tables (orders, comments, logs)
Search indexes (Elasticsearch, Algolia)
Caching layers (Redis, Memcached)
File storage (S3, local disk)
Third-party integrations (analytics, email services)

Create a data inventory by auditing your application’s data flow. This prevents incomplete deletions that leave residual data.

SQL Database Deletion Patterns

For relational databases, the challenge lies in maintaining referential integrity while deleting user data. Use cascading deletes where appropriate, or implement soft deletes for audit requirements.

PostgreSQL Example

-- Begin a transaction for atomic deletion
BEGIN;

-- Delete dependent records first (orders, sessions, etc.)
DELETE FROM user_orders WHERE user_id = 'user-uuid-here';
DELETE FROM user_sessions WHERE user_id = 'user-uuid-here';
DELETE FROM user_activity_log WHERE user_id = 'user-uuid-here';

-- Delete the user record last
DELETE FROM users WHERE id = 'user-uuid-here';

COMMIT;

For applications requiring audit trails, consider soft deletes that mark records as deleted without physical removal:

UPDATE users
SET deleted_at = NOW(),
    email = CONCAT(id, '-deleted-', EXTRACT(EPOCH FROM NOW()), '@deleted.invalid'),
    name = 'Deleted User'
WHERE id = 'user-uuid-here';

This approach preserves aggregate data for analytics while removing personally identifiable information.

MongoDB Deletion Patterns

MongoDB’s flexible schema requires a different approach. Use bulk operations for efficient deletion across collections:

async function deleteUserData(userId) {
  const db = client.db('your_application');

  // Define deletion operations for each collection
  const operations = [
    { deleteMany: { filter: { userId: userId } } },           // user_sessions
    { deleteMany: { filter: { userId: userId } } },           // user_profiles
    { deleteMany: { filter: { userId: userId } } },           // user_orders
    { deleteMany: { filter: { 'metadata.userId': userId } } }, // activity_logs
    { deleteOne: { filter: { _id: userId } } }                 // users collection
  ];

  // Execute all operations
  const results = await Promise.all(
    operations.map(op => db.collection('users').bulkWrite([op]))
  );

  return results;
}

Implementing the Deletion Request Handler

Create a dedicated endpoint to handle deletion requests. This endpoint should:

Verify user authentication
Validate the request
Queue the deletion for async processing
Return confirmation to the user

from flask import Flask, request, jsonify
import asyncio
from datetime import datetime

app = Flask(__name__)

@app.route('/api/account/delete', methods=['POST'])
@require_authentication
def request_account_deletion():
    user_id = get_current_user_id()

    # Log the deletion request for compliance
    audit_log.info(f"Deletion request: user_id={user_id}")

    # Queue async deletion task
    deletion_task = asyncio.create_task(delete_user_data_async(user_id))

    # Send confirmation email (using anonymized template)
    send_deletion_confirmation(user_id)

    return jsonify({
        'status': 'deletion_scheduled',
        'message': 'Your data deletion has been scheduled',
        'estimated_completion': '24-48 hours'
    }), 202

async def delete_user_data_async(user_id):
    """Async worker that performs actual data deletion"""
    await delete_from_database(user_id)
    await delete_from_cache(user_id)
    await delete_from_search_index(user_id)
    await delete_from_file_storage(user_id)
    await notify_third_party_services(user_id)

Handling Cascade Deletes

User data rarely exists in isolation. Implement a cascade deletion service that tracks relationships:

# Define deletion dependency graph
DELETION_DEPENDENCIES = {
    'users': ['user_sessions', 'user_orders', 'user_notifications'],
    'user_orders': ['order_items', 'order_shipments'],
    'user_sessions': ['session_events']
}

async def delete_user_data_async(user_id):
    """Delete user data respecting dependency order"""
    for table in topological_sort(DELETION_DEPENDENCIES):
        await delete_table_data(table, user_id)

    # Finally, delete from primary users table
    await db.users.delete_one({'_id': user_id})

Verifying Complete Deletion

After deletion, verify that all user data has been removed:

async def verify_deletion_complete(user_id):
    """Check all data stores for remaining user data"""
    checks = {
        'database': await check_database(user_id),
        'cache': await check_redis(user_id),
        'search': await check_elasticsearch(user_id),
        'backup': await check_backup_systems(user_id)
    }

    remaining = {k: v for k, v in checks.items() if v}

    if remaining:
        alert_security_team(f"Incomplete deletion for {user_id}: {remaining}")
        return False

    return True

Handling Data Retention Requirements

Some data cannot be deleted due to legal retention requirements. Implement a data minimization strategy:

Retain financial records as required by tax law (typically 7 years)
Keep security logs for incident investigation
Preserve data necessary for legal obligations

Create a data classification system that tags each field with its retention requirement:

DATA_CLASSIFICATION = {
    'user_id': {'retention': 'account_lifetime', 'deletable': False},
    'email': {'retention': 'account_lifetime', 'deletable': True},
    'order_history': {'retention': 'legal_7_years', 'deletable': False},
    'session_tokens': {'retention': '90_days', 'deletable': True},
}

For non-deletable data, implement anonymization that preserves analytical value while removing personal identifiers.

Testing Your Implementation

Thoroughly test your deletion implementation:

Unit tests: Verify each deletion function removes correct records
Integration tests: Test full deletion flow across all systems
Compliance tests: Audit deleted records to confirm complete removal
Performance tests: Deletion should complete within SLA (typically 30 days per GDPR)

@pytest.mark.asyncio
async def test_user_deletion_removes_all_data():
    user_id = await create_test_user()

    # Add data across systems
    await add_test_order(user_id)
    await add_test_session(user_id)

    # Perform deletion
    await delete_user_data_async(user_id)

    # Verify removal
    assert await db.users.find_one({'_id': user_id}) is None
    assert await db.user_orders.count_documents({'userId': user_id}) == 0
    assert await redis.exists(f'session:{user_id}') == 0

Implementing the right to be forgotten requires careful attention to data architecture, cascade relationships, and verification processes. By building these capabilities into your application from the start, you ensure compliance while respecting user privacy.

Built by theluckystrike — More at zovo.one