Question

A privacy engineer is designing the erasure workflow for a customer platform that uses a primary relational database plus a separate Elasticsearch cluster to power full-text search. When a validated deletion request is processed, records are removed from the relational database, but testing shows that deleted customers' names and email addresses remain returnable through the search interface for several hours. Which design change BEST ensures the erasure obligation is technically enforced across the system?

Accepted Answer

Make the search index deletion part of the same erasure transaction/orchestration so both stores are updated as a single completed operation before the request is marked fulfilled

Answer

Rely on the next full nightly reindex job to eventually remove the stale documents from the search cluster

Answer

Encrypt the search index at rest so that residual personal data is protected until it is overwritten

Answer

Add a legal disclaimer to the search UI stating that recently deleted records may still appear temporarily