GDPR erasure request handled in 48h on production database. Three months later, test restore from monthly snapshot: profile reappears. Nobody had listed copies.
Right to erasure (GDPR Art. 17) requires deleting all relevant copies — not only the visible row. In hosting: replicas, snapshots, CDN, logs (if identifiers), caches, support exports, analytics subprocessors.
Map copies to erase
Production — database, files, search index. Backups and snapshots — purge or anonymization policy. CDN and cache — edge invalidation. Logs — anonymization if legal retention prevents raw delete. Subprocessors — cascading instruction via host.
| Copy | Action | Typical delay |
|---|---|---|
| Prod DB | DELETE | Immediate |
| Snapshot | Cycle purge | ≤ 30–90 d |
| CDN | URL purge | Hours |
| Cold archive | Host ticket | Contractual |
Deleting in prod without touching backups means telling the user yes while keeping their data.
Process with the host
Send written instruction (ticket) with concerned identifier list. Require written host confirmation and update register. DPA clause must cover erasure assistance and end-of-contract certificate.
See Legal archiving if legal retention conflicts with erasure — analyze case by case. Cross-check Backup location to know all copies.
The peak: silent violation
Decide and move forward without blind spots
Document erasure workflow now with exhaustive copy list per system. Test on dummy account verifying backup restore does not bring erased data back. Integrate snapshot purge in retention policy. See directory and compare tool to choose a host transparent on erasure assistance.
Frequently asked questions
Must the host delete on request?
Yes as processor on documented instruction; copies under their control included.
Do backups prevent erasure?
Purge or anonymization within documented reasonable delay, except legal obligation.
How to prove deletion?
Ticket, certificate, backup purge logs, cascading subprocessor confirmation.
End of hosting contract?
Certified deletion plus prior export — mandatory DPA clause.
GDPR erasure is proven when no useful copy can bring data back — not when the prod row vanished.