Customer 360 Enterprise Data Platform — Denodo on Azure · View 26 of 39 · Runtime
Decisions
- The crosswalk is what makes erasure provable — it is the only place that knows all five identifiers for one person. Without it, a subject access request is a manual trawl and completeness cannot be asserted.
- Denodo finds the copies; the owning system performs the deletion. The platform has no write path and does not acquire one for privacy.
- The enterprise id is tombstoned rather than removed, so a later reappearance of the same person cannot silently reuse it.
Numbers
- Statutory window 30 days; the assembly step itself runs in minutes, and the elapsed time is dominated by identity verification and source-side erasure.
- Every export and every erasure instruction is recorded with the acting principal and retained 13 months.
Risks
- Erasure in the lakehouse rewrites Delta partitions and is slower than the source-side deletions. Until it completes, a copy exists — the case stays open until every destination has acknowledged.
