You took the names out. Everybody is still identifiable.

The junkyard

A thousand tables and nobody to ask.

Somebody messages you: can you send me the shipping delays data? Perfectly reasonable request. You open the warehouse. Eleven hundred tables, with names like ship_evt_v3, pay_ref_2021, usr_master_bkp and stg_merge_tmp.

Three questions, and you cannot answer any of them. Which one is the right table? One of them has a field called px_ref. What is that for? And is anyone still here who knows?

Nothing failed here. No pipeline broke. No number is wrong. The warehouse just grew faster than people could remember it. One day it stopped being useful and became a pile.

The habits that stop this are called governance. None of them are exciting.

And once those tables hold real people, something else turns up. The law. That part is not your choice.

Two words, two questions

One is a habit. One is the law.

People teach these two as one subject, which confuses everyone, because only one of them is your choice. Here is the link worth keeping. Good governance is what makes the law possible to follow. You cannot remove someone from everywhere if nobody knows where everything is.

What governance means in practice

Four questions someone must be able to answer.

All four are dull. All four decide one thing. Do people use your tables, or give up and build their own copy? Giving up is how a company ends up with eleven hundred tables.

The one that does the work

Only one of the four looks after itself.

Catalogs go out of date. So do the definitions. An owner does not, because an owner is a person, and people get asked things.

In practice it is dull. Every table that matters has one name against it. That person answers when the returns team asks what is inside. Not a team inbox. Not a ticket queue. A person.

You do not get documents out of this. You get answers in ten minutes instead of guesses. And when something is wrong, one person’s job is to care.

Why that happens

The name was never the risky part.

Everyone assumes the risky columns are names, emails and card numbers. Hide those three and the job is done. Try it in the table above. Hide all three, and every single row still points at one person.

Here is why. What gives a person away is the mix, not any one column. A city on its own tells you nothing. A birth date on its own tells you nothing. A gender on its own tells you nothing. Put all three in the same row and you usually have one exact human being.

So you cannot check this one column at a time. Look at the whole row and ask one question. How many other people in this table look exactly like this one? If the answer is none, that row is still a person.

And the fix is usually not more hiding. It is less detail. A birth year instead of a birth date. A state instead of a pincode. Keep going until nobody is standing on their own.

There is no word you need to learn here. You need the habit of checking. A table can pass a column-by-column review and still be a list of named people.

Three laws, in plain words

Nobody expects you to be a lawyer. They do expect you to build this.

Each of these is a sentence on a page until somebody writes the code underneath it. A right to be removed is worth nothing until an engineer can find every copy of one customer, across a dozen systems, and take her out of all of them. Building that is the job. It is the next chapter.

The nuance nobody mentions

Half of these are not deletions.

The first thought is DELETE FROM customers. It is wrong in two separate ways.

First, you are often not allowed to delete the order. In most countries, tax rules say a record of a sale must be kept for years.

So two laws pull opposite ways. You do not pick one. You keep the order and cut its link to the person. The sale still happened, for the right amount, on the right day. It is just no longer attached to anybody.

customers
support_tickets
marketing list

orders        → customer_id null
fct_orders    → key replaced
analytics     → token only

Second, some places cannot be changed at all. A backup is a frozen copy on purpose. That is what it is for. Reach into last Tuesday’s copy and edit one person, and it is not a backup any more.

What you do instead

For the three you cannot simply delete.

And under all of it: write down that you did it. From the outside, a deletion you cannot prove looks the same as one that never happened.

That is the quiet argument for this whole chapter. Knowing where everything was, before anyone asked, turns a two-week hunt into a twenty-minute job.

Why it is worth your attention

This is the clearest line between junior and senior.

A junior engineer moves data from one place to another and it works. That is a real skill. It is most of what the job advert asks for.

A senior engineer finishes the same pipeline, then asks four questions nobody asked for. Can someone else find this table? Does anyone know what the columns mean? Whose name is on it? And can the wrong people see what is inside?

None of those four are hard. They are invisible when you do them and very obvious when you do not. That is why people skip them, and why doing them gets you noticed.

If you get asked

“Someone asks to be deleted. Walk me through it.”

The thin answer is one sentence about a delete statement. What is really being asked is this. Do you know how many copies of one person a company collects without meaning to?

Start by finding, not deleting. Say you would first work out everywhere that person exists. Production, the warehouse, exports, logs, caches, backups, and anything sent to another company. Then say what makes that list possible: a catalog and lineage, instead of memory.

Then split deleting from anonymising. Orders stay, because the law says they must. The link to the person is what goes. That one sentence puts you ahead of most people in the queue, because it shows you know two laws can pull opposite ways.

Then be straight about backups. You cannot edit them. You mark her, and you let them expire. Saying that calmly sounds like someone who has done it.

Then say you would log it. Proof matters as much as the act.

If there is time, add the other half. Hide personal data, and give people only the access they need. Then fewer places hold the real thing, and every one of these requests gets smaller.

Two questions

Did it land?