MAP · CONTROL · RECONCILE
Data policy: separate use, export and deletion
Follow actual fictional records through primary storage, a backup, an export and a restore.
Scroll the diagram horizontally to inspect every label. The panels below give the same state as text.
Your experiment
The opening request is verified, same-tenant and consented, so use, export and deletion all proceed. Keep consent checked and switch the actor to Beta: every request is denied. Then restore Alpha and clear consent: only the day 1 purpose check changes.
Play takes one minute at 1×. Pause, step or scrub the computed history. Input changes reset the experiment without autoplay. Red cards identify a previously deleted record that returned from backup.
Export snapshot
An export already copied to another destination is not automatically revoked by erasing the source.
Decision trace
Complete record and tombstone inventory
Technical teaching fixture, not legal advice, a GDPR/DPDP compliance assessment or an operational data-deletion service. All records and identities are fictional. The modeled policies are explicit choices, not statutory deadlines or legal bases. Verification and consent are switches, not identity checks or valid consent collection. Retention runs at days 9 and 20. Requested deletions schedule one backup purge; retention-expired backup copies remain visible and require a separate real-world policy. Tombstones block restoration; they are not anonymization. Holds are a fixture exception, not a legal determination. Real systems also need authorization roles, downstream deletion, backup lifecycle, notices, audit protection and jurisdiction-specific review. No personal information or external service is accessed. Official AICassindra learning resources.
Three requests, three different permissions
Six fictional records start in primary storage and in the backup. Tenant alpha owns a1, a2 and a4 for subject s1, where a4 is a billing record, and a3 for subject s2; tenant beta owns b1 and b2. The opening request comes from a verified alpha actor about subject s1 with Personalization purpose consent checked. The day 1 purpose check permits use of three scoped records, the day 2 export copies a1, a2 and a4, and the day 3 deletion removes a1 and a2 while Hold billing records against deletion keeps a4. Use, export and erasure are three separate decisions recorded as three separate trace entries.
Consent does not authorize export or erasure
Clear Personalization purpose consent. Only the day 1 entry changes, to use denied; the export still copies three records and the deletion still removes two. Now check consent again and set Actor tenant to Beta. The trace shows use denied, export-denied and delete-denied with no record IDs, the export snapshot stays empty, and the day 12 late write is refused. Clearing Identity verified by the fixture, or setting Requested tenant to Beta while the actor stays Alpha, produces the same three denials. Consent is a purpose condition on use; it never substitutes for identity or tenant authorization.
Scope decides which records each request touches
Set Requested subject to Subject s2: use covers one record, the export contains only a3, and the deletion removes a3 with no held record. Return to s1 and choose Whole tenant / offboarding under Request scope: the export copies four records, a1 to a4, the deletion removes a1, a2 and a3, and because the tenant is now offboarded the day 12 late write is denied instead of creating late-1. On day 17 the backup purge removes the same three deleted records from the backup.
Retention, holds and restores are separate rules
Clear the billing hold and the subject deletion also removes a4, so three records leave primary storage and three are purged from the backup on day 17. Set Retention window to 10 days and the day 9 sweep removes a3, b1 and b2 as expired, independently of any request. Set Backup purge after deletion to 0 and the purge moves to day 3. Clear Block restoration of deleted IDs: the day 10 restore brings back a1, a2 and b2, and the day 11 check reports three deleted records back in primary storage. Clear Minimize export fields and each exported copy also carries tenant, subject and age.
How to read the replay and its limits
Play, Pause, Next event, Restart, Speed and the Inspection slider replay ten scheduled days across sixty seconds, one stage every six seconds, and any edit recomputes the run and rewinds it. Verification and consent are switches in a fictional fixture, not identity proofing or valid consent collection, and the purpose check only gates one modeled use. Real data governance also needs a purpose register, lawful basis, downstream and processor deletion, backup lifecycle and jurisdiction-specific review. This is a teaching model, not legal advice.