Deletion and export test cases, where the export itself is the breach

A data export is the single most concentrated collection of personal data your product will ever produce: profile, messages, activity, uploads and billing in one downloadable file. That makes the delivery mechanism more sensitive than anything it contains. A link without authorisation on every request, without an expiry, or without the underlying file being deleted at expiry turns a compliance feature into a breach waiting for someone to find the URL. Re-authentication before generating one belongs in the same group, because an unattended session should not be able to package the whole account for collection.

Deletion is only real if it reaches everywhere the data went, and it went further than the primary table. Avatar derivatives, search indexes, application caches, edge cached pages, object storage, logs, analytics and every third party processor you forwarded data to. Each is a separate case and each is a place where the record survives a deletion the user believes completed. Backups are the hardest of these, because a restore performed for an unrelated reason will resurrect the account unless a suppression list or a documented backup expiry policy handles it.

The distinction between deletion and anonymisation is a product decision that has to be stated rather than implied. Financial records usually must be retained for statutory periods, so the correct behaviour is to strip personal identifiers while keeping the record, and to tell the user that is what happens. The related case is aggregates: historic reporting totals should not retrospectively change when an account is deleted, or every figure you previously published becomes unreproducible.

Finally, the cases that pull in the opposite direction. Deletion must be refused where a legal hold applies, because destroying held records is more serious than retaining them. Shared and collaborative content cannot simply vanish and take other people work with it. An export must exclude other people data, since another person messages are their record rather than the requester. And the whole thing is auditable: demonstrating compliance requires recorded evidence of who requested what, how they were verified, and when it completed.