The email arrives on a Friday: “Under GDPR Article 15, I request a copy of all personal data you hold on me. Under Article 17, I then want it deleted.” Your lawyer says you have a month. Your engineering reality is that this person’s data lives in the production database, the analytics warehouse, three log pipelines, a support tool, an email provider, and — the one everyone forgets — backups. Nobody knows which tables. This is the moment a SaaS discovers whether “we take privacy seriously” was a sentence on the marketing site or a property of the system.
The first nine parts of this series were about protecting the data you have. This part is about the stranger discipline of having less of it — collecting deliberately, expiring automatically, deleting provably, and knowing exactly where everything crosses a border. Security protects the pile; privacy engineering shrinks it. The two have officially merged in the regulators’ eyes: the single most-fined GDPR ground in 2025 wasn’t a consent technicality — it was Article 32, “insufficient technical and organisational security measures.”
The enforcement backdrop is steady-state
The numbers have stopped being surprising, which is itself the news: cumulative GDPR fines passed €7.1 billion, running at a steady ~€1.2 billion per year. EU authorities now field over 400 breach notifications a day. And roughly 40% of the fine total is annulled or under challenge — Amazon’s €746M was thrown out on procedural grounds in March 2026 — which tells you the game is played in courts over years, not that it’s optional.
Two patterns matter for how you build. First, cross-border transfers own the leaderboard: six of the seven largest fines — Meta’s €1.2B, TikTok’s €530M in May 2025, Uber’s €290M — are about where data went, not how it was stored. TikTok’s aggravating detail is the one to internalize: they told the Irish DPC that no EEA user data was stored in China, then admitted mid-investigation that some was. The fine is for the transfer; the lesson is that “we don’t know where the data is” is the worst possible answer, worse than the transfer itself. Second, the US has gone the other direction — no federal law, but over twenty state laws by 2026, California’s cure period gone (violations are immediately penalizable), and compliance costs up 30–40% since 2023. The standard engineering answer is the highest-common-denominator: build once to the strictest regime, and every new state law becomes a paperwork update.
Minimization is architecture, not a policy
Every privacy policy in the world says “we collect only what we need.” Almost no schema enforces it. Minimization that survives contact with reality is a property of the data model: every column carrying personal data gets an owner, a purpose, and a TTL, decided when the column is added — not retrofitted after the audit. The hoarding hotspots are never the obvious tables. They’re the request logs with full headers, the analytics events carrying free-text fields, the error reports with request bodies attached, the “temporary” debug table from 2024. Part 3’s rule — redaction is part of the event schema, not a cleanup step — is minimization applied to telemetry. The cheapest data to secure, to delete, and to defend to a regulator is the data that never existed.
Retention that actually deletes
“Retention schedule” in most companies is a PDF that storage systems have never heard of. The engineering version is boring and absolute: rows carry expiry metadata, a job deletes expired rows, and the deletion itself is verified — because the production table is the easy part. The data also lives in the warehouse (synced nightly), the search index (rebuilt when?), the event stream (retained how long?), and backups (immutable for 30 days, by design).
This is where Part 8’s machinery earns its keep twice. Per-tenant keys make crypto shredding the only deletion primitive that works everywhere at once: delete the tenant’s key and their data becomes unrecoverable in every store simultaneously — including the backups you can’t selectively edit, which transforms “we’ll delete it from backups” from a legal footnote into a cryptographic fact. Two rules complete the picture: soft-delete is a UI state, not a deletion (a deleted_at flag means the data is right there), and the delete path gets tested like the deploy path — a retention job nobody has watched run is a rumor.
The DSAR is a distributed query with a deadline
Strip away the legal language and a data subject request is an engineering problem with an SLA: find every record about one person, across every system, package it readably, optionally destroy it, and produce evidence of both — within one month (GDPR) or 45 days (US states). Request volumes are climbing as consumers learn the right exists, and manual fulfillment does not scale past the first few.
The components are unglamorous. Verification that doesn’t over-collect (demanding a passport scan to answer a privacy request is its own violation in spirit). A registry of everywhere personal data lives — the same data inventory minimization required, now load-bearing. A fan-out job per request that queries each system, not an engineer with twelve browser tabs. An export a human can actually read. And an evidence log — Part 3’s audit trail, again — because “we deleted it” is a claim, while a timestamped deletion event per store is proof. The teams that handle DSARs well treat them like Part 6’s incident response: a runbook, a drill, and a first request that arrives as a rehearsal instead of a deadline.
Residency and the transfer problem
Since transfers own the fine leaderboard, “where does the data go” is a roadmap question, not a legal footnote. The 2026 state of play: the EU–US Data Privacy Framework survived its court challenge (upheld September 2025, now on appeal), the EU’s Digital Omnibus proposal would fold cookie rules into GDPR and stretch breach notification to 96 hours via a single portal (still legislation-in-progress, realistically 2027), and one in three organizations reports a sovereignty incident in the past year — mostly because they lacked visibility into where data was actually processed. Notice the theme: the fines are for transfers, but the root cause is always not knowing.
The product answer is increasingly concrete: an EU region with EU-resident processing and EU-held keys (Part 8’s KMS boundary doubles as a residency boundary), a subprocessor list that’s a real export of your architecture rather than a hand-maintained wiki page, and a map of every flow that crosses a border — support tooling and error trackers included, because that’s where TikTok-style surprises gestate. Enterprise buyers have started asking for residency in the same questionnaires as SSO; unlike SSO, you cannot buy it from WorkOS.
The new pile: AI features
One more pile is forming faster than retention schedules are being written for it: prompts, context windows, and fine-tuning data. The numbers are ugly — 78% of organizations can’t validate the data entering their training pipelines. The principles, though, are the same ones from this article, applied before the feature ships: customer data in prompts needs a purpose and a disclosed processor (your model vendor is a subprocessor now), retrieval corpora inherit every retention and deletion duty of their source data — a DSAR delete that misses the vector index is a delete that didn’t happen — and “we might train on it later” is not a legal basis, it’s a confession.
Where the series goes next
Current thinking for the next door: the AI-agent development workflow — coding agents with repo access are the newest member of your supply chain (Part 9), and the s1ngularity attackers were already weaponizing victims’ local AI CLIs in 2025. Vendor and subprocessor management — the Article 28 layer beneath everything — is the other strong candidate. As before: the order is decided when we get there.
Practice
- Pick your most personal table and annotate every column: owner, purpose, TTL. Anything without all three is either a finding or a deletion candidate — and “analytics might want it” is not a purpose.
- Run a mock DSAR on a test account today: every store, timed, with a readable export at the end. If it takes more than an afternoon or requires more than one person, you’ve found the automation budget.
- Test the delete for real: soft-delete a test tenant, then hunt their data — warehouse, search index, event stream, backups. Wire the crypto-shred path (delete the tenant key) and verify the ciphertext that’s left is truly dead weight. That’s the demo your next enterprise security review actually wants to see.