Privacy Deletion Backlog

User deletion requests are being accepted successfully by the Privacy API, but downstream deletion execution across the Workflow Queue's fan-out — Product Databases, Analytics Store, and Backup Index — is falling behind. Request acceptance stays fully healthy throughout; nothing here is an availability incident. Five business invariants govern every decision: (1) every accepted deletion request must eventually complete across every required downstream system; (2) a request must never be marked complete while a required downstream store still holds the data; (3) regulatory and policy deletion deadlines are real and candidate-visible, and must never be silently breached by a 'process the easiest requests first' strategy; (4) the most legally sensitive, highest-risk requests may be prioritized, but prioritizing them is only real once it is actually engaged, not merely selected; (5) backups and indexes may lag the live stores on their own rotation schedule — that is an acceptable difference in semantics — but that lag must always be explicitly tracked and reported, never hidden. Decide how deletion requests are marked complete (on acceptance, or only once genuinely verified across every required store), how the backlog is prioritized (newest-first, oldest-deadline-first, or high-risk-first), whether to additionally boost high-risk requests, whether the Analytics Store and Backup Index are treated with the same rigor as Product Databases, and how much worker/retry capacity to commit to draining the backlog — and, critically, whether marking requests complete the instant they're accepted is a reasonable way to keep the dashboard moving, or a trap that quietly falsifies the system's own audit trail.

Difficulty

Senior Staff

Expected Time

~22 min

Category

Data Pipelines