SRE Best Practices Practical By Samson Tanimawo, PhD Published Jul 14, 2026 4 min read

The Data Deletion Discipline No Team Has

Most teams delete data poorly. The four-step discipline that satisfies GDPR, prevents lawsuits, and reduces storage cost.

Audit what you have

Inventory every data store with personal data. Most teams find more than they expected.

Tag each store with: source, customer-identifying-fields, retention period, deletion mechanism.

Anything without a deletion mechanism is a liability. Tag it; fix it.

Data deletion windows: when a customer requests deletion, the data must be gone within N days. GDPR is 30; pick something defensible.

Tombstone deleted records. Audit trails should show 'deleted at X by request Y' even after the data is gone.

Backups: deletion includes backups. Most teams forget. Backups are not exempt from GDPR.

A deletion request fires a workflow. The workflow walks every data store; the workflow logs every deletion.

End-to-end test: the workflow is exercised in pre-prod with synthetic customers. The end state is verified.

Without automation, deletion is manual and unreliable. Manual deletion misses backups, secondary stores, analytics warehouses.