---
name: pdpa-data-deletion
description: Implement PDPA/GDPR right-to-erasure (anonymize in place). Use when a user requests deletion.
---

# Skill: PDPA Data Deletion (Right to Erasure)

## When to use

A data subject requests erasure (PDPA §33 / GDPR Art. 17).

## Approach: anonymize in place, don't hard-delete

Use `database/scripts/anonymize/anonymize_user.sql` as the model:

1. Overwrite PII fields with deterministic anonymous values.
2. Delete credentials + refresh tokens.
3. Preserve the row + FKs so audit history + aggregate reports stay intact.
4. Write `audit_logs` (`action: 'pdpa.anonymize'`).

## Gotchas

- Don't break referential integrity — anonymize, don't `DELETE` the user row that audit logs point to.
- Some records have a **legal retention** requirement (financial, audit) that overrides erasure — check `data-retention.md` first.
- Anonymize across ALL tables with the subject's PII, not just `users`.
- Make it idempotent — re-running on an already-anonymized user is a no-op.
- Run inside a transaction; log before commit.

## Validation

PII gone from every table; FKs intact; legal-hold records preserved; idempotent; anonymization audited.
