Blog
Notes from Erasure
Product and documentation updates. We only publish when there is something real to say, no invented customers or metrics. How we write.
- Data deletion
Deleting a User's Data from MySQL: Dependency Order and Transactions
MySQL has its own traps when you delete one user's data: no deferrable foreign keys, the FOREIGN_KEY_CHECKS footgun, and InnoDB locking. Here is the safe order.
Read →
- Data deletion
How to Delete a User's Data from PostgreSQL Without Breaking the Database
Deleting one user's data from Postgres means finding every table that references them, handling foreign keys in the right order, and running a safe parameterized DELETE. Here is the working method.
Read →
- Privacy evidence
Audit Trail vs Evidence: What Privacy Review Actually Needs
A server log is not an audit trail, and an audit trail is not evidence. When a reviewer asks what happened, you need a portable record, not a query into noisy logs.
Read →
- Data deletion
Webhook Retries and Idempotency for Deletion Workflows
When a deletion job depends on webhooks, retries are guaranteed and duplicates are certain. An idempotency key and a signature check are what keep the system safe.
Read →
- Consent management
Consent Database Schema: How to Store Consent So You Can Prove It Later
A consent record that survives scrutiny needs three things: what the user saw, what they chose, and when. Here is a schema design that keeps all three, append-only.
Read →
- Data deletion
Soft Delete vs Hard Delete for Privacy Requests
A soft-deleted row is still data. For privacy deletion requests, the flag that hides it is not the same as the deletion a regulator can see. Here is when each makes sense.
Read →
Why AI Search Will Decide Which Privacy Tools Get Recommended
ChatGPT, Perplexity, and AI Overviews now mediate how buyers find software. Privacy tools that get cited win; the rest become invisible. Here is what earns an AI recommendation.
Read →
- Consent management
Verifiable Parental Consent Under DPDP: What It Means for Your Product
DPDP defines a child as under 18 and requires verifiable parental consent for processing a child's data. Behavioural monitoring and targeted ads to children are prohibited outright.
Read →
- Data deletion
The Real Cost of Manual DSAR Processing (and What Automation Changes)
Manually processing a data subject request averages over $1,400 in staff time per Gartner estimates. Here is the cost model, and what automation changes for Indian startups.
Read →
- Data deletion
How to Handle Data Deletion Requests: An Operational Guide for Startups
A practical workflow for handling data deletion requests in an Indian startup: intake, verification, fulfilment across systems, timelines, and evidence. No compliance team required.
Read →
DPDP Breach Notification: The 72-Hour Rule and the CERT-In Complication
DPDP Rules require notifying the Data Protection Board within 72 hours of a breach. But CERT-In has its own reporting clock. Here is the runbook that handles both.
Read →
Does GDPR Apply to Indian Companies? The Extraterritorial Question
GDPR applies to any company processing data of EU residents, including Indian companies with EU users. Here is when GDPR touches Indian businesses and how it overlaps with DPDP.
Read →
- Data mapping
Data Mapping: Knowing Where Personal Data Lives Before You Need To
Data mapping is the inventory of where personal data lives, what identifiers map to a person, and how to act on it. It is the prerequisite for every deletion request under DPDP.
Read →
- Data deletion
Right to Erasure Under DPDP: How Deletion Requests Actually Work
The right to erasure under India's DPDP Act is the operational heart of the law. Here is how a deletion request flows from receipt to verification to fulfilment across systems.
Read →
- Privacy operations
Significant Data Fiduciary Under DPDP: Are You One, and What Changes
The DPDP Act lets the government designate Significant Data Fiduciaries with extra duties: DPIAs, data audits, an India-based DPO. Here is what SDF status means in practice.
Read →
- Consent management
Cookie Banners in India: DPDP Notice vs GDPR-Style Consent
India's DPDP Act requires notice and consent differently from GDPR. Here is what a compliant Indian cookie banner or consent surface looks like, and where GDPR patterns mislead.
Read →
DPDP Timeline 2026-27: Every Enforcement Date You Need
Every material DPDP Act date: assent August 2023, Rules notified November 13 2025, Consent Manager registration November 2026, penalty enforcement expected May 2027.
Read →
- Consent management
Consent Receipts: Why Proof of Consent Is the Real Compliance Asset
A consent receipt records what a user saw, what they chose, and when, in a form that survives configuration changes. Under DPDP, the receipt is the difference between a banner and a defense.
Read →
- Privacy operations
DPDP Compliance Checklist for Indian Startups (2026)
A practical, itemized DPDP compliance checklist for Indian product companies: notice, consent, data inventory, deletion workflows, evidence, and security safeguards.
Read →
GDPR vs DPDP: The Complete Comparison for Engineering Teams
GDPR and India's DPDP Act differ on legal bases, notice, breach timelines, children's data, and rights. Here is the comparison that matters for product and engineering decisions.
Read →
- Consent management
What Is a Consent Manager Under DPDP? Definition and Requirements
DPDP defines consent managers as fiduciaries that enable data principals to give, manage, and withdraw consent through a single platform. Registration opens November 2026.
Read →
DPDP Penalties: What the ₹250 Crore Cap Means for Startups
India's DPDP Act caps penalties at ₹250 crore per violation, with enforcement expected from May 2027. Here is how the penalty regime actually works and what it means for product companies.
Read →
- Consent management
Consent Under DPDP: The Five Conditions That Decide Whether It Counts
DPDP Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by clear affirmative action. Here is what each condition means for product design.
Read →
- Privacy operations
DPDP Rules 2025 Explained: What Changed and What You Must Do
The DPDP Rules were notified on November 13, 2025 with a phased rollout. This breaks down notice, consent, security, breach reporting, and SDF obligations into engineering work.
Read →
- Consent management
Consent Management Platform Guide: What a CMP Actually Does
A consent management platform (CMP) handles notice, choice, and proof of consent. Here is what one should do, what most CMPs miss, and what DPDP adds on top.
Read →
- Privacy operations
DPDP Act 2023: The Complete Guide for Indian Product Companies
India's Digital Personal Data Protection Act is in force, with rules notified in November 2025 and penalties expected from May 2027. Here is what product teams actually need to do.
Read →
Public product docs live at /docs
Erasure now ships product documentation on the marketing site. What it covers, and what it is not.
Read →