hardScenarioDesignSeniorStaffLead
A legal hold lands on Friday afternoon and your nightly deletion jobs run at two. What do you do, and what do you build afterwards?
6 min readUpdated 2026-08-15
Answer
Short answer
Suspend deletion only for the scoped records, not everywhere, which means hold has to be a first-class state that overrides the retention schedule. The engineering work is scoping the hold, suppressing every deletion path including backup expiry, and paying down the deletion debt that accumulates once the hold lifts.
Keep legal hold explicit in the answer because that is the concept the interviewer is actually trying to test.
Was this answer helpful?
Likely follow-ups
- An erasure request arrives for a subject already inside the hold scope. What do you do first?
- How do you demonstrate months later that nothing in scope was deleted after the hold date?
- Preserve in place or collect to a separate store, and what changes about access control either way?
- The hold scope is defined in business terms your data model cannot express. How do you narrow it?
Related questions
- How do you design a system so an auditor can prove who accessed a record and why?mediumAlso on audit-trail and retention8 min
- You need to change a field on a live trial's data capture system. What evidence does that change have to produce?hardAlso on audit-trail7 min
- The operations team says there is no rule for this, they just use judgement. How do you model that?hardAlso on audit-trail7 min
- Fraud and AML say keep it for years, privacy says delete it. How do you build a system that satisfies both?hardAlso on retention6 min