Enforcing GDPR Right to be Forgotten at scale

WHAT THIS TESTS Privacy engineering judgment: the realization that deletion means different things in immutable object storage, a columnar warehouse, and an ephemeral cache, and that compliance requires proof, not just intent.

A GOOD ANSWER COVERS Begin with discovery, because you cannot delete what you cannot find: maintain a data map or catalog that links a data subject id to every dataset, table, and key holding their personal data, including derived and aggregated copies. For the raw lake on S3, deletion is hard because objects are large and immutable and a user's data is interleaved with others. Crypto-shredding is the standard answer: encrypt each user's data with a per-user key and destroy the key to render data unrecoverable, avoiding costly file rewrites; alternatively rewrite affected partitions. In Snowflake, run targeted DELETEs but account for Time Travel and zero-copy clones that retain history, so set retention appropriately and purge fail-safe-bound copies, then rebuild any materialized aggregates. For Redis and other caches, evict the specific keys and rely on short TTLs as a backstop. Backups and logs also need covering, often via documented retention windows.

COMMON WRONG ANSWERS Issuing one DELETE and assuming propagation. Forgetting immutable backups, replicas, Time Travel, and derived tables. Ignoring verifiability, the legal core of compliance. No handling of the statutory response window.

VERIFIABILITY AND ORCHESTRATION Drive the erasure with an orchestrated, idempotent, retryable workflow that fans out per system, records each step in an immutable audit log, and produces a completion record. Re-scan afterward to confirm no residual records and surface status to demonstrate compliance.

ONE CONCRETE EXAMPLE A user requests erasure. The orchestrator looks up their id in the catalog, destroys their per-user S3 encryption key, runs DELETEs in Snowflake while shrinking Time Travel on affected tables, evicts their Redis keys, logs each action with timestamps, and finally runs a verification scan that returns zero rows, closing the request well within the legal window.