Agent Wranglers

DAT-79Recommended

Pause deletion for records under a legal hold

Let a named role put a hold on an account or a set of records, with a reason and a review date. Every deletion job and erasure request skips held records and logs why.

By Agent Wranglers. Updated .

How to do it

A dispute, a tax audit or a court case can require you to keep data that your schedule would delete. GDPR Article 17(3) lets you keep data for legal claims or a legal duty, even after an erasure request. Store holds in their own table, and make Delete old data automatically and the erasure code check it. Tell the person which data you kept and why, through the flow in Let people see and delete their data. Lift each hold when its matter closes, and the next run deletes the data. Records the law keeps for a set period follow Keep payment records for the legal period.

Examples

SQL example

CREATE TABLE legal_holds (
  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
  account_id bigint NOT NULL REFERENCES accounts (id),
  reason text NOT NULL,
  placed_by text NOT NULL,
  review_on date NOT NULL,
  lifted_at timestamptz
);

DELETE FROM messages m
WHERE m.expires_at < now()
  AND NOT EXISTS (
    SELECT 1 FROM legal_holds h WHERE h.account_id = m.account_id AND h.lifted_at IS NULL
  );

How to check

Put a hold on a test account on staging, then run the retention job and an erasure request. Its rows stay, and the job log names the hold. Lift the hold, and the next run deletes them.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data/personal-data/legal-hold">Agent Wranglers data and databases playbook</a>. In code you write, add a comment next to it with the same link.