---
title: "Erase retired databases and every copy · Agent Wranglers"
url: https://agentwranglers.se/playbook/data/personal-data/retired-data-stores
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Erase retired databases and every copy

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/data/rules.json) holds every rule of this playbook as JSON.

- Level: Required
- Chapter: [Personal data](https://agentwranglers.se/playbook/data/personal-data)
- Rule: When a database, replica or test copy is no longer needed, erase it with every snapshot and volume it left behind. Record what was erased, how and when.
- Risk: Data leaked or lost
- How: Start from the [data map](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map), and list the store's replicas, snapshots, disk volumes, staging restores and exported files. GDPR Article 5 keeps personal data only as long as its purpose needs it, and forgotten copies break that. On cloud storage you cannot wipe the disks yourself. NIST SP 800-88 Rev. 2 names cryptographic erase for this case, where destroying the key makes the data unreadable. So encrypt each store with its own key from a key service. Delete the database, its snapshots and volumes, then schedule the key for deletion once the last backup has expired. The expiry itself is set in [backup retention](https://agentwranglers.se/playbook/operations/disaster-recovery/backup-retention). Create and delete those keys as [Keep encryption keys in a key service](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/key-management) describes.
- Check: For each retired store in the data map, a listing of the cloud account finds no database, snapshot or volume with its name or tag. The erasure record names the store, the method and the date.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# AWS CLI as an example: expect an empty list for the retired database
aws rds describe-db-snapshots --query "DBSnapshots[?DBInstanceIdentifier=='shop-old'].DBSnapshotIdentifier"
# Cryptographic erase: the key goes after the last backup has expired
aws kms schedule-key-deletion --key-id alias/shop-old --pending-window-in-days 7
```

### SQL example

```sql
-- A self-hosted copy: drop it, then destroy the volume or the key that encrypted it
DROP DATABASE shop_staging_restore;
```

## Sources

- [NIST SP 800-88 Rev. 2 Guidelines for Media Sanitization](https://csrc.nist.gov/pubs/sp/800/88/r2/final)
- [GDPR Article 5 on principles of processing](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- [Map every store that holds personal data](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map) in Compliance
- [Keep backups for a set time](https://agentwranglers.se/playbook/operations/disaster-recovery/backup-retention) in Operations
- [Keep encryption keys in a key service](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/key-management) in Infrastructure

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/data/personal-data/retired-data-stores">Agent Wranglers data playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Log who reads personal data](https://agentwranglers.se/playbook/data/personal-data/access-logging)
- [Personal data](https://agentwranglers.se/playbook/data/personal-data)