Data Retention Policy Misconfiguration

The Deletion Service's most recent retention-policy rollout is misconfigured: Financial Records that must be retained for the mandated 7-year window — or are under active legal hold — are being wrongly purged from the Archive. Application uptime and Event Store write success remain fully healthy throughout; nothing here is an availability incident. Four business invariants govern every decision: (1) data under legal hold or mandated retention must never be deleted, regardless of what the misconfigured policy currently says; (2) data past its own mandated deletion deadline must not be retained indefinitely merely because fixing deletion feels riskier than doing nothing; (3) different data classes — Financial Records, User-Deletion-Request data, Ephemeral Logs — have genuinely different retention requirements and must never be treated uniformly; (4) once a record is wrongly deleted, that loss is permanent and irreversible, not a recoverable backlog state. Decide whether to correct the retention policy for the specific data class that is actually broken, whether to enforce legal holds independently of the policy itself, whether to audit affected records before or after applying the fix, whether to validate the correction against a sample before rolling it to production, and — critically — whether a fleet-wide emergency halt of all deletion is the cautious response it looks like, or a trap that creates a second, unrelated violation on a data class that was never part of the problem.

Difficulty

Principal

Expected Time

~25 min

Category

Data Pipelines