GDPR Article 15 and 17: Access and Erasure, Implemented

The full executive answer

Both rights are executed code, not support tickets. Access and portability (Article 15/20): the platform generates a machine-readable export bundle of every organisation-scoped table — thirty-plus data categories, from assessments to audit entries — with metadata that includes a per-table classification of which exported columns hold personal or sensitive data, because a DPIA-conscious export should describe itself. Beyond the organisation-level export, we implemented individual data-subject access: a maintained register of every table holding personal data about a person — by email or authorship — is searched for subject-access responses, with a code comment that captures the discipline: platform tables outside the organisation scope are deliberately excluded so one tenant's DSAR can never read another tenant's subjects.

Erasure (Article 17): a real deletion pipeline, not a flag. An erasure request schedules organisation deletion thirty days out — auditable and cancellable, the standard grace window against fat-fingered or coerced requests — after which the cascade delete removes all organisation-scoped rows via database-level cascade rules, so orphaned personal data in forgotten child tables is structurally impossible rather than dependent on someone remembering. Every request is itself recorded in a gdpr_requests table and the audit log, so you can evidence to your regulator that the right was honoured, when, and by whom.

The genuinely interesting edge case — and I'll volunteer it before you ask — is erasure versus the append-only audit trail: deleting rows from a hash-chained log would break the tamper-evidence that other regulations expect us to keep. Our resolution is pseudonymisation: identifying fields in historical audit entries are nulled while the rows and their hashes survive, satisfying the erasure right while preserving evidentiary integrity — the approach EDPB guidance recognises, since GDPR treats properly pseudonymised-then-unlinkable data as outside the erasure obligation's practical reach. That trade-off is documented in the code itself.