When deletion of a decision or data is requested, how should the…

Direct answer

First separate the request into distinct objects: source data, decision content, event record, audit record, backup, model influence and third-party copy. Decide separately for each object whether to delete, destroy, anonymise, restrict or retain it for a defined period. Retention continues only for a specific legal, security or accountability purpose, with the minimum necessary content and access. A legal hold has an owner, reason, scope and review date. A deletion receipt carries minimum evidence of the operation, not a hidden copy of the deleted content.

In plain language

When destroying a letter, you may retain a short receipt saying that it was properly destroyed on a certain date. The receipt should not secretly reproduce the entire letter.

Why this matters

Deleting everything may destroy evidence needed for audit or redress; retaining everything 'for audit' makes the request to be forgotten meaningless. Separating objects and purposes controls both extremes.

Do not confuse

Deletion ends access and ordinary use; the technical method varies by context.
Destruction seeks stronger assurance that the data cannot be recovered.
Anonymisation aims to prevent the person's identity from being reasonably reconstructed.
A legal hold is a temporary, auditable retention restriction for a specific legal need.
An audit receipt proves an operation; it is not a complete backup of the deleted content.

What should you do?

Separate the request into data, decision, log, backup, model-influence and third-party objects.
For each object, define its owner, purpose, legal basis, retention period and appropriate treatment.
Delete or destroy unnecessary content and minimise the content and access of any retained record.
For a legal hold, record the authorised owner, scope, reason, start, end and periodic review.
Propagate the request to recipients, downstream systems, backup processes and, where relevant, model review.
Keep object identifier, method, scope, time, result and remaining exception in the deletion receipt.
Test that restricted records cannot be reused and that expired holds truly end.

How do you audit it?

Was the request decomposed into every data and decision object?
Does each retained field have a specific purpose, basis and retention period?
Was a complete copy of deleted content retained under an audit rationale?
Is the legal hold narrow, authorised, dated and reviewed periodically?
Were downstream systems, backups, exports and third parties included?
Were deletion of stored data and removal of model influence confused?
Were the receipt, exception and remaining uncertainty explained appropriately to the requester?

Limit

Deletion, retention, anonymisation, legal hold and notification duties vary by jurisdiction and purpose. Not every request requires every record to be destroyed, and no audit purpose justifies unlimited retention. Legal and privacy specialist review is required.