The right to erasure — even from your backups and archives.
Article 17 says delete the person's data. But a backup or compressed archive can't be edited without restoring, modifying and recompressing the whole thing — so most teams quietly ignore their archives, or destroy them wholesale. AT-1 erases one data subject from a sealed archive by destroying their key, in milliseconds, and hands you a signed certificate that proves it.
Every compressed backup (gzip, zstd, xz) and every archive still contains a data subject's personal data, opaque and physically un-editable without a full restore-modify-recompress cycle. At backup scale, doing that for a single erasure request is impossible — so organisations either leave the data recoverable (the erasure isn't real) or destroy whole archives (losing records they must retain). Neither is an acceptable answer to a legally-mandated right, with fines up to 4% of global revenue.
Why the usual options don't work
| Approach | Keeps archive integrity | Feasible at scale |
|---|---|---|
Ignore the backups / archives leaves the person's data recoverable — the erasure isn't real, and you have to document why | ||
Restore → delete → recompress the whole archive correct in theory, impossible at backup scale for one deletion request | ||
Drive-wipe (NIST 800-88 / DoD) sanitises a whole drive — you cannot erase one person from a shared, retained archive | ||
AT-1 per-subject crypto-erasure destroy one key → that person is irrecoverable; the archive is untouched and re-verifies |
How per-subject crypto-erasure works
- One key per person. On write, each data subject's personal data is encrypted under a unique per-subject key, held in a separate vault.
- Erase = destroy the key. A right-to-erasure request destroys that one key in milliseconds — independent of archive size. The encrypted bytes remain but are permanently unrecoverable.
- The archive never moves. No decompress, no rewrite. Its content hash is identical before and after, so every other record stays intact and the integrity proof still holds.
- Certificate as evidence. A signed proof-of-deletion certificate records the subject, time, key-destruction proof and before/after hashes — your deletion log, cryptographically backed.
Right-to-erasure questions, answered
- Do I have to erase personal data from backups under GDPR Article 17?
- In principle yes — the right to erasure extends to backups and archives, not just live systems. Regulators accept that immediate physical deletion from backups can be technically hard, but the burden is on you to either delete it or document why you cannot and when it will go. AT-1 removes that excuse: you can erase one data subject from the archive without restoring it.
- How does AT-1 erase one person from a compressed archive without rewriting it?
- Each data subject's personal data is encrypted under its own key. Erasing them destroys that single key, which renders their data permanently irrecoverable. Nothing is decompressed or rewritten, the archive bytes are byte-for-byte identical before and after, and every other record stays intact and queryable.
- Is cryptographic erasure (crypto-shredding) valid for the right to be forgotten?
- Crypto-shredding — permanently destroying the key so the ciphertext can never be decrypted — is an established, regulator-recognised erasure method. It is also the only approach compatible with a tamper-evident archive: physically excising bytes would break the integrity proof you also need for audit.
- Can I prove the deletion actually happened?
- Yes. Every erasure emits a signed certificate: subject ID, timestamp, a key-destruction proof, and the archive hash before and after (identical). It is documentary, admissible evidence for a Data Protection Authority — the deletion log regulators expect, cryptographically backed rather than a spreadsheet entry.
Honest scope: cryptographic erasure renders data permanently inaccessible by destroying its key; the ciphertext is not physically overwritten. This is the accepted reading of Article 17 for immutable backups, and the only one compatible with a tamper-evident archive. AT-1 is a technical control that makes erasure demonstrable — it does not replace your wider data-protection programme.
Send a sample — we'll erase a subject on it and return a signed certificate.
Start a free proof