Rights requests and deletion jobs

What it is

A Rights request (engineering: Case) is the aggregate for one subject privacy obligation. In v1 the fulfillment type is DELETE. Starting a verified request enqueues a durable job (rights.delete) executed by a worker.

Why it exists

A deletion request is not an email. It needs verification, multi-system execution, retries, partial-failure honesty, and exportable proof.

Lifecycle

         ┌─ cancel ─────────────────────────────┐
         │                                      ▼
OPEN ────┼── start ──► IN_PROGRESS ──► COMPLETED
(verify) │                  │
         │                  └── fail ──► FAILED

Field	Values
Status	OPEN, IN_PROGRESS, COMPLETED, FAILED, CANCELLED
Verification	UNVERIFIED, VERIFIED, FAILED (orthogonal to status)

Start requires:

Verification VERIFIED
Start readiness: enabled Systems; map-backed systems need ≥1 DELETE entity with identifiers

How cases are created

Path	Behaviour
Public intake	OTP challenge → case created only after verify (VERIFIED, `verifiedVia: otp` where recorded)
Operator	Console create; operator may mark VERIFIED (trust-the-operator, not OTP proof)

OTP: hashed at rest, single-use, attempt limits, rate limited; production email via Resend (or log provider in non-prod). Never return OTP codes in API JSON in production.

Execution

Start
  → enqueue Job (rights.delete)
  → Worker claims (SKIP LOCKED)
  → Fulfill each enabled System (Data Map for SQL)
  → COMPLETED or FAILED (+ partial honesty in timeline/Evidence)

Outcome	Meaning
Completed	Fulfilment path finished successfully for enabled systems
Failed	Permanent or exhausted failure. See Activity
Partial	Some systems OK, some failed. Recorded honestly where product supports it
Retry	Retryable errors requeue with backoff

Worker is required: bun run worker (or your deploy’s worker process). Without it, jobs stay pending.

What jobs are not

Not direct "delete from the UI" SQL
Not ACCESS/CORRECT product types (not first-class yet)
Not fulfillment against systems you never connected

Systems · Data Maps
Evidence · Operational readiness
Guide: Handle a deletion request · DPDP: Deletion requests

Rights requests and deletion jobs

On this page