# Export and erase personal data

**Flow key:** `data-export-and-erasure`

## Outcome

The verified data subject can request, receive, and understand a complete authorized export and can erase or restrict eligible data with truthful exceptions and completion evidence.

## Actors

- Data subject
- Privacy service
- Identity/data owners
- Third-party processors
- Support/compliance

## Preconditions and entry points

- A synthetic account has known data across profile, content, logs, billing, integrations, and backups.
- Jurisdiction, identity proof, retention exceptions, SLA, and processor inventory are known.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Subject | `carbon.privacy+001@example.test` | unverified, disabled, former user, multi-tenant identity |
| Known data | profile, two records, message, file, audit, invoice | shared content, derived analytics, support ticket |
| Proof | fresh authenticated/step-up session | expired, wrong account, delegated request |
| Request | export then erasure | restriction, correction, cancellation, duplicate request |
| Processors | synthetic integration records | unavailable processor, legal hold, backup retention |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Open privacy request controls. | Request types, scope, proof, timing, consequences, and exceptions are understandable. |
| 2 | Verify identity and submit export. | One request records subject, scope, jurisdiction, version, and deadline. |
| 3 | Receive and inspect the protected export. | Data is complete, portable, explained, correctly scoped, and accessible only to the subject. |
| 4 | Submit erasure/restriction and confirm. | Ownership, shared data, billing/legal retention, and irreversible consequences are explicit. |
| 5 | Process primary, indexed, cached, derived, integrated, and retained data. | Each system records delete, anonymize, retain, or restrict outcome. |
| 6 | Verify completion and attempt later access. | Account/data behavior, audit, processor status, and truthful exceptions match the receipt. |

## Alternate paths

- Self-service export
- Verified support request
- Erasure
- Restriction/correction
- Cancel within grace period

## Failure and recovery paths

- Export omits a system
- Download link leaks
- Deletion job partially fails
- Shared content keeps direct PII
- Processor or backup exception is misrepresented

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [privacy](../../items/quality/privacy.md)
- [export](../../items/content/export.md)
- [delete](../../items/actions/delete.md)
- [account and user lifecycle](../../items/identity/account-and-user-lifecycle.md)

[Back to Resilience and privacy flows](index.md)
