For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Risk if broken

Data leaked or lost

How to do it

Start from the data map, and list the store's replicas, snapshots, disk volumes, staging restores and exported files. GDPR Article 5 keeps personal data only as long as its purpose needs it, and forgotten copies break that. On cloud storage you cannot wipe the disks yourself. NIST SP 800-88 Rev. 2 names cryptographic erase for this case, where destroying the key makes the data unreadable. So encrypt each store with its own key from a key service. Delete the database, its snapshots and volumes, then schedule the key for deletion once the last backup has expired. The expiry itself is set in backup retention. Create and delete those keys as Keep encryption keys in a key service describes.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

# AWS CLI as an example: expect an empty list for the retired database
aws rds describe-db-snapshots --query "DBSnapshots[?DBInstanceIdentifier=='shop-old'].DBSnapshotIdentifier"
# Cryptographic erase: the key goes after the last backup has expired
aws kms schedule-key-deletion --key-id alias/shop-old --pending-window-in-days 7

SQL example

-- A self-hosted copy: drop it, then destroy the volume or the key that encrypted it
DROP DATABASE shop_staging_restore;

How to check

For each retired store in the data map, a listing of the cloud account finds no database, snapshot or volume with its name or tag. The erasure record names the store, the method and the date.

Sources

• NIST SP 800-88 Rev. 2 Guidelines for Media Sanitization
• GDPR Article 5 on principles of processing

Related rules

• Map every store that holds personal data in Compliance
• Keep backups for a set time in Operations
• Keep encryption keys in a key service in Infrastructure