Users can request permanent deletion of their personal data and account

GDPR Art. 17 — the 'right to be forgotten' — requires permanent deletion of personal data when the user requests it and no overriding legal basis for retention exists. A soft-delete that sets a deleted_at flag without a subsequent purge job leaves PII sitting indefinitely in your database, which is a direct Art. 17 violation every day after the grace period expires. Cascade failures are equally common: deleting the user row while leaving activity logs, uploaded files, and messages orphaned with the original user_id and any associated PII is not erasure. Regulators do not accept 'the data is inaccessible through the UI' as equivalent to deletion.

Implement two-phase deletion: immediate access revocation followed by a cron-triggered full purge after a documented grace period (typically 14–30 days).

// Phase 1: app/api/user/delete/route.ts — revoke access immediately
export async function DELETE() {
  const session = await getServerSession()
  if (!session?.user?.id) return new Response('Unauthorized', { status: 401 })
  await db.user.update({
    where: { id: session.user.id },
    data: { email: `deleted-${session.user.id}@purged.invalid`, name: 'Deleted User', deletedAt: new Date() }
  })
  await db.session.deleteMany({ where: { userId: session.user.id } })
  return Response.json({ ok: true })
}

// Phase 2: app/api/cron/purge-deleted-users/route.ts — run after grace period
export async function GET() {
  const cutoff = new Date(Date.now() - 30 * 86400_000)
  const toDelete = await db.user.findMany({ where: { deletedAt: { lt: cutoff } }, select: { id: true } })
  for (const { id } of toDelete) {
    await db.$transaction([
      db.activityLog.deleteMany({ where: { userId: id } }),
      db.consentRecord.deleteMany({ where: { userId: id } }),
      db.order.updateMany({ where: { userId: id }, data: { userId: null, customerEmail: 'purged@deleted.invalid' } }),
      db.user.delete({ where: { id } }),
    ])
  }
  return Response.json({ purged: toDelete.length })
}

Also delete uploaded files from object storage inside the purge loop. Document any data retained beyond the grace period (e.g., financial records for 7 years under tax law) with its Art. 6(1)(c) legal obligation basis.