How do you fulfill a GDPR erasure request across data stores?

WHAT THIS TESTS: This question evaluates your ability to design a distributed data deletion workflow that satisfies GDPR right to erasure across the full data lifecycle. Interviewers want to see that you understand the 30 day response deadline, the difference between logical and physical deletion, and the complexity of removing data that has been replicated, backed up, or aggregated. It also tests your awareness of tradeoffs between compliance, system integrity, and auditability.

A GOOD ANSWER COVERS: First, discovery and lineage. You must locate the user's PII across raw data stores like S3, structured databases, and analytics warehouses. This requires a data catalog or tagging strategy so you know every object, table, partition, and derived dataset that contains the identifier. Second, raw object stores. For S3, this means deleting or overwriting the specific objects, or if the data is in immutable logs, using cryptographic erasure by shredding the encryption keys for that user's data. Third, structured databases. Here you need cascading hard deletes that respect referential integrity, or soft deletes with a tombstone flag if the record must be retained for legal hold while scrubbing PII fields. Fourth, aggregated analytics. Dashboards that count active users or sum revenue must be addressed by either reprocessing the underlying data pipeline to exclude the user or by using differential privacy techniques that prevent singling out the individual. Fifth, backups and replicas. You need a retention aware strategy: mark backups containing the user for crypto erasure at the end of their retention period, or if immediate deletion is required, restore, purge, and re backup. Sixth, audit and verification. The process must emit logs proving deletion completion to demonstrate compliance.

COMMON WRONG ANSWERS: The biggest red flag is proposing a single SQL DELETE in the primary database and assuming the job is done. Another mistake is ignoring immutable architectures such as append only event streams or WORM S3 buckets where standard deletion is impossible. Candidates also err by saying they will simply subtract one from every dashboard aggregate without considering that the user might have contributed to complex metrics like averages or funnels. Failing to mention the 30 day SLA or legal exemptions such as contractual obligations is also a weakness.

LIKELY FOLLOW-UPS: How would you handle a user ID that appears in a Kafka log or Kinesis stream that is already consumed by five downstream services? What if the backup is on Glacier with a 90 day minimum retention? How do you prove to a regulator that deletion was complete without revealing other users' data? Would you use soft deletes everywhere or mix strategies based on data classification?

ONE CONCRETE EXAMPLE: Suppose a user requests erasure. Your service receives the request and writes a deletion event to an SQS queue. A mapper task queries AWS Glue Data Catalog to find all S3 prefixes, Redshift tables, and DynamoDB items tied to that user ID. For S3, it issues targeted delete object calls and adds the prefix to a manifest for key shredding if the bucket uses SSE KMS. For Redshift, it runs a transaction that deletes from the users table and cascades to orders and events tables, then vacuumes the table to reclaim space. For the QuickSight dashboard showing monthly active users, you trigger an Airflow DAG that reprocesses the last 90 days of activity, excluding the deleted user, and repopulates the aggregate table. Finally, a compliance worker writes a signed attestation to a DynamoDB audit table within 72 hours, well inside the 30 day window.

Source: aws.amazon.com