Source code
Security & compliance
Code quality
No retention / erasure path on PII table
Part of the GDPR & privacy check · fix arrives as a guide
What it is
A table holding personal data has no retention policy and no deletion path for a specific person's records.
Why it matters
Article 17 gives individuals a right to erasure, and Article 5 requires that data not be kept longer than necessary. "We cannot delete it" is not a defence, and building the path under a 30-day deadline is worse than building it now.
How to fix it
Define a retention period per table and implement a scheduled job that enforces it. Build and test the erasure path for one person's data across every table, including backups policy and any downstream processor.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.