GDPR Article 17 deletion path exists and is tested

GDPR Article 17 grants EU residents the right to erasure of their personal data — and it is not optional for any system that serves EU users. Without a coded deletion path, every right-to-erasure request requires manual database surgery by an engineer, which is slow, error-prone, and leaves no audit trail. CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) covers the broader pattern of not handling PII lifecycle correctly. CCPA §1798.105 grants California residents similar rights. An untested deletion path is nearly as risky as no deletion path: without automated verification, the cascade almost certainly misses tables, leaving PII silently intact.

Implement a deletion service in src/lib/compliance/deletion.ts that anonymizes PII in place (preserving aggregate integrity) and writes an erasure receipt. Add at least one test that asserts PII is gone after the call:

// src/lib/compliance/deletion.ts
export async function processErasureRequest(
  contactId: string,
  requestedBy: string
): Promise<ErasureReceipt> {
  const startedAt = new Date()

  await db.contact.update({
    where: { id: contactId },
    data: {
      email: `deleted-${contactId}@erasure.invalid`,
      firstName: null,
      lastName: null,
      phone: null,
      deletedAt: startedAt
    }
  })

  const receipt = await db.erasureAuditLog.create({
    data: { contactId, requestedBy, processedAt: startedAt, tablesAffected: ['contacts', 'consent_records'] }
  })

  return { receiptId: receipt.id, processedAt: startedAt }
}

// src/__tests__/erasure.test.ts
it('removes PII from contacts table', async () => {
  const contact = await createTestContact({ email: 'test@example.com' })
  await processErasureRequest(contact.id, 'test-runner')
  const after = await db.contact.findUnique({ where: { id: contact.id } })
  expect(after?.email).not.toContain('test@example.com')
})