Consent & Privacy Service  ·  View 05 of 22  ·  People and journeys

Journey — Delete My Account

Every phase after the second belongs to somebody else's system. That is why erasure is a protocol, not a call.

Editable source SVG draw.io All views
Departing user has already decided Goal — Be gone, and be told when it is actually done Trigger — Switching to a competitor, or one bad experience too many Done when — A confirmation naming what was deleted and what legally stays 1 · Decide 2 · Prove who I am 3 · Wait ◆ moment of truth 4 · Hear back 5 · Stay gone ◆ moment of truth What they do Taps delete account Completes step-up Reads the outcome Watches their inbox What the platform does Case opened Identifiers resolved Fan-out to 100 targets Attestations collected Suppression list holds How it feels Satisfied Uneasy Angry Where it hurts ID asked to be forgotten Days of silence Some data legally kept A vendor emails anyway What answers it Proportionate verification Acknowledged in 24 h Plain-language refusals Probing finds the vendor Journey — Delete My Account Every phase after the second is somebody else's system behaving. That is why erasure is a protocol with four states rather than a call with a return code. v 1.0 · owner Security & Identity Architecture

The trough, and the answer

  • The low point is Wait: days of silence while a hundred targets are instructed. The answer is a 24-hour acknowledgement, a case identifier, and a case state that is never inferred from elapsed time.
  • Being asked to prove identity in order to be forgotten is the journey's most resented moment and is non-negotiable: an unverified erasure request is an attack on the subject, not a service to them.
  • The final phase is the one most designs miss. A vendor emailing a deleted subject is detected by sampled absence probing, not by trusting the attestation that vendor already sent.

Assumptions

  • Acknowledged within 24 h; verification decided within 72 h; attested complete across first-party systems within 7 days at p95; external recipients within 30 days absolute.
  • A 5-day margin is held against the statutory ceiling.

Risks

  • Partial fulfilment is lawful and will feel like refusal. The plain-language reason is the only mitigation, and it has to be written before the first case, not after the first complaint.
  • The suppression list is the single control standing between a backup restore and a resurrected subject. A restore path that skips it voids every completed erasure.
◀  Journey — Withdraw a Consent All views Journey — Answer a Regulator  ▶
Solution Architecture v1.0 · Amazon Web Services · Security & Identity Architecture · 2026-1005-journey-delete-my-account