Source deletion cascades or anonymizes contacts

GDPR Art. 17 (right to erasure) and Art. 5(1)(e) (storage limitation) require that personal data be erased when the basis for holding it no longer applies. If a purchased list is invalidated — the vendor is found to have collected it unlawfully, or the list exceeds its contractual retention period — you need a reliable mechanism to remove or anonymize all contacts derived from that source. CWE-459 (Incomplete Cleanup) applies when deletion of a parent record leaves orphaned child records with dangling foreign keys and no defined disposition.

Define explicit cleanup behavior for source deletion via a database trigger. Anonymization (replacing source_id with a tombstone) is preferred over cascade deletion when you need to retain aggregate analytics.

-- Option 1: Anonymize on source delete (preferred)
CREATE OR REPLACE FUNCTION anonymize_contacts_on_source_delete()
RETURNS TRIGGER LANGUAGE plpgsql AS $$
BEGIN
  UPDATE contacts
  SET source_id = 'deleted:' || OLD.id
  WHERE source_id = OLD.id;
  RETURN OLD;
END;
$$;

CREATE TRIGGER on_source_delete
  BEFORE DELETE ON data_sources
  FOR EACH ROW EXECUTE FUNCTION anonymize_contacts_on_source_delete();

-- Option 2: Cascade delete (use when retention is not needed)
ALTER TABLE contacts
  ADD CONSTRAINT fk_contacts_source
  FOREIGN KEY (source_id) REFERENCES data_sources(id)
  ON DELETE CASCADE;