hardScenarioMidSeniorStaff
A GDPR erasure request arrives for a patient whose data sits in an append-only clinical audit log. What do you do?
6 min readUpdated 2026-08-15
Answer
Short answer
You do not delete first. Erasure is a qualified right that yields where other law requires retention, so you triage each dataset by its lawful basis, erase what has no basis to be kept, suppress and restrict what must be retained, and put the residual judgement to legal and records management.
Was this answer helpful?
Likely follow-ups
- Which parts of this estate could you have designed differently a year ago to make the request cheap to satisfy?
- The audit log lives on immutable object storage with a retention lock. What is your plan for it?
- How do you keep restored backups from silently reinstating data you suppressed?
- The same person later asks for a copy of everything you hold. Does your suppression design still let you answer?
Related questions
- A customer's API token turns up in a public repository. What do you do in the next hour, and what in your token design decides how bad this is?hardAlso on audit-logging7 min
- How would you know if a clinician had opened the record of a patient they were not caring for?hardAlso on audit-logging6 min
- Your observability bill is now bigger than your compute bill. What do you cut first, and what must you never lose?hardAlso on audit-logging5 min
- A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?hardAlso on audit-logging6 min