gdpr-compliance-issue-1256

[dn-scribe]

Assessment of the project's compliance to GDPR User-Data-Deletion Requirement

Analysis Bottom Lines

Criterion	Status
Data deletion mechanism exists	❌ Not user-triggered
Deletion completeness/cascade	⚠️ Partial (DB only)
User-triggerable deletion	❌ Absent
Verifiability / audit	❌ Absent
Retention periods defined	❌ Absent
No irreversible backups/logs	⚠️ Unknown/Absent
Documentation (policies)	❌ Absent
Automated tests for deletion	⚠️ Partial (cron)

Compliance Level: ❌ Non-Compliant — no clear deletion process exists for user-request data erasure.

---

Recommendations

1. Implement a user-request deletion API/UI to trigger erasure of personal data on demand (e.g., DELETE /api/user/{id}).
2. Extend deletion cascade to related records (attachments, mail logs, caches, backups) or mark them for expiration.
3. Introduce retention-period configuration (e.g., in ir.config_parameter) and document default values.
4. Add audit logging for deletion events (who requested, when, what was removed).
5. Publish documentation on data retention and deletion procedures (GDPR.md or docs/PRIVACY.md).
6. Create automated tests to simulate a full data erasure flow and verify no residual personal data remains.

---

Report generated based on compliance/gdpr/requirements/standard_req__data_deletion.md analysis.