IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The right to be forgotten
Maya asks a company to delete her account. It sounds like one button. Done well, it is a careful process. Your goal: explain the steps of a proper erasure and the copies people forget.
- Cut access first. Delete data last.
- A cooling-off window lets you undo a mistake.
- Erase copies too, such as AI vectors.
- Keep only the data the law makes you keep.
Support deletes only Maya's profile and says "done". A month later the company's AI helper answers a question using her old support tickets. Maya sees it. She complains. Now the company must explain why "deleted" was not true.
Revoke before you delete
Order matters. The right to be forgotten is a person's right to have their data erased (GDPR Article 17). It does not start with deleting rows. It starts by cutting access. First block the account. Then end every live session and every refresh token. Now the person, or an attacker who sent the request, cannot keep acting while the work runs. Only then does the data go.
The cooling-off window
Between "revoke" and "erase" there is a cooling-off window. It is a pause that you can undo. People make mistakes, and a support agent may need to cancel. Access is already gone, so waiting costs nothing. Deleting too early cannot be undone. Each step needs step-up: check the person again before it runs.
The copies you forgot
The identity record is rarely the only copy. An AI feature may have stored the person's data as RAG vectors in a shared knowledge index. Vectors are lists of numbers, called embeddings. A knowledge agent can still find them after the account is gone. Erasure must remove those too. Rules such as GDPR cover personal data wherever it is stored. Derived copies count too.
What you may keep
Erasure has limits. The law lets you keep some data, such as financial records that you must hold for a set time. Keep only what the law requires. For your security audit log, keep the trail but cut the link to the person. Replace the name with a random ID. Then delete the table that maps the ID back to Maya. Backups are not edited record by record. They expire on their own schedule. A restore must never bring deleted data back. People often log such a request as a DSAR. Strictly, the name means a request to see your data, but many teams use it for erasure too.
This is not only a European rule. India's DPDP Act, 2023 also lets a person ask a company to erase data held on their consent. The company must do it, unless the law needs the data kept. See the regulations lesson.
Recalling a library book and every photocopy of it. Taking the original off the shelf is not enough if copies still circulate in the back office.
Maya asks to be forgotten. Her login is blocked and her sessions end in seconds. Her account waits in a short cooling-off window that she can cancel. When the window ends and she confirms, the delete removes her identity record. It also removes the vectors that an AI helper had stored about her. Only then is she truly gone.
Go deeper: The legal limits
GDPR Article 17(3) lets you keep some data, such as financial records that you must hold by law.
The whole process must stay inside GDPR's one-month deadline (Article 12(3)). A complex request, or many requests at once, can add up to two more months, if you tell the person why.
🧪 Interactive lab — enable JavaScript to play with this one.
Need erasure that reaches derived copies and meets GDPR? Talk to our team.