A customer emails a retailer asking it to delete everything it holds about her. The same week, the retailer's lawyers tell IT that her account is part of a lawsuit and nothing connected to it may be deleted. Both instructions are legitimate, they point in opposite directions, and the security team runs the systems that have to honor them.
On the CompTIA Security+ SY0-801 exam, privacy and legal compliance sit under objective 5.4, which expects you to summarize the elements of an effective security compliance program. This lesson covers the privacy rights the objective names, who is responsible for honoring them and who owns the data, and the legal duties that can override them: legal holds, legal orders and data retention requirements.
Privacy laws give people rights that your systems must be able to honor
Modern privacy laws give individuals rights over the personal data organizations hold about them. GDPR, which covers the European Economic Area and has a near-identical UK version, calls these individuals data subjects. California's CCPA, as amended by the CPRA, calls them consumers, and many other U.S. states and countries have similar laws. Details differ by law, so this lesson uses GDPR and California as examples of the concepts the exam tests.
A right only means something if the organization can carry it out. That takes a data inventory, so you know every system that holds a person's data; an intake process for requests, often called data subject requests; and deadlines. GDPR gives an organization one month to respond, extendable by two more months for complex or numerous requests. California allows 45 days, extendable once by another 45.
Identity verification is the security team's main contribution. A rights request is an attractive social engineering path: an attacker who asks for a copy of someone's data is attempting theft, and one who asks to change the email address on file is attempting account takeover. Requests are verified to a level that matches the sensitivity of the data before anything is released or changed, and every request and response is logged as proof of compliance.
The right to be forgotten means finding and erasing every copy, within limits
The right to be forgotten, which GDPR formally calls the right to erasure, lets a person have their personal data deleted in defined situations, for example when the data is no longer needed for its original purpose, they withdraw consent and no other legal basis applies, they successfully object to the processing, or it was processed unlawfully. California's right to delete is similar. The phrase took hold after a 2014 EU court ruling that made search engines delist certain results about individuals.
The right is not absolute. An organization can keep data it needs to comply with a legal obligation, such as tax records, or to establish, exercise or defend legal claims, among other exceptions. Erasure is therefore often partial: the marketing profile and browsing history go, while the invoices stay until the tax retention period ends.
The hard part is technical. Personal data lives in production databases and their replicas, data warehouses, analytics tools, search indexes, caches, logs, email, file shares and SaaS applications, and with every processor that received it. The controller must pass the erasure on to the processors and other recipients it disclosed the data to, unless that proves impossible or would take disproportionate effort. Backups are the usual sticking point, because rewriting them is rarely practical. A common approach, which some regulators have accepted, is to leave the backup untouched, never use it for anything else, let it expire on its normal rotation, and keep a suppression list so a restore doesn't bring deleted records back into production.