# `database/scripts/`

Ops scripts: backup, restore, anonymize.

| Folder / file                  | Purpose                                        |
| ------------------------------ | ---------------------------------------------- |
| `anonymize/anonymize_user.sql` | PDPA / GDPR right-to-erasure for a single user |

Backup + restore wrappers land in Phase 8 (`platform/observability/` + `docs/runbooks/disaster-recovery.md`) since they're hosted-environment-specific.

## Anonymization model

Right-to-erasure replaces personally-identifying fields with deterministic anonymous values **in place** rather than deleting the row. This preserves:

- foreign-key integrity (audit logs still link back),
- aggregate reports (counts stay accurate),
- regulatory audit trail (we can demonstrate the action was performed).

Every anonymization writes an `audit_logs` row with `action='pdpa.anonymize'`. See [`docs/compliance/right-to-erasure-runbook.md`](../../docs/compliance/right-to-erasure-runbook.md) (Phase 8) for the operator runbook.
