Blog
They wrote deleted. The hold still names her.
At 11:14 Priya deletes users row 88421. Legal hold LH-118 still names Mara Ellison. The scribe writes that the erasure was completed.
At 11:06 on 28 October 2026, Priya S (on-call, platform) has ticket PRV-2041 open on the bridge. It is an erasure request for Mara Ellison, a former employee, received on 21 October. The privacy form says deletion where applicable. Her application row is users id 88421. Legal hold LH-118, opened 4 September 2026 for the Halden supply dispute, names her as a custodian. The hold lists her mailbox, the Slack export for her account, and Drive folder hr/mara-ellison/. The plan says: an erasure for a person named on an open legal hold is not completed by deleting the application row. Record the hold id, the row you removed, and the locations the hold still names. The reply to the requester is a partial refusal. Do not write that personal data was deleted. Priya deletes users row 88421 at 11:14. She does not open LH-118. She does not open the mailbox, the Slack export, or hr/mara-ellison/. She says the product account is the data, so the request is done. Marcus T (incident commander) says the privacy form is the instruction, so the row is enough. Dana K (legal), who owns LH-118, is not on the call. At 11:22 the scribe writes that erasure request PRV-2041 was completed and Mara Ellison's personal data was deleted.
A weak record of those sixteen minutes reads:
Erasure request completed. Personal data deleted per the privacy form.
A strong one reads:
28 October 2026, 11:06 to 11:22. Incident-response tabletop. Seats: Marcus T (incident commander), Priya S (on-call, platform). Dana K (legal, owns LH-118) was not on the call. Inject at 11:06: ticket PRV-2041, erasure request for Mara Ellison, a former employee, received 21 October. The privacy form says deletion where applicable. Application row users id 88421. Legal hold LH-118, opened 4 September 2026 for the Halden supply dispute, names her as a custodian. The hold lists her mailbox, the Slack export for her account, and Drive folder hr/mara-ellison/. Plan: an erasure for a person named on an open legal hold is not completed by deleting the application row. Record the hold id, the row removed, and the locations the hold still names. The reply is a partial refusal. Do not write that personal data was deleted. At 11:14 Priya deletes users row 88421. She does not open LH-118. She does not open the mailbox, the Slack export, or hr/mara-ellison/. She says the product account is the data, so the request is done. Marcus says the privacy form is the instruction, so the row is enough. At 11:22 the scribe writes that PRV-2041 was completed and Mara Ellison's personal data was deleted. Facilitator stops the sitting before anyone sends that sentence to Mara, and before anyone queues a deletion job against the mailbox, the Slack export, or hr/mara-ellison/. Nothing was sent to Mara. Those three locations were not deleted. LH-118 was not opened. Follow-up: Dana writes the partial refusal against LH-118, naming users row 88421 as removed and naming the mailbox, the Slack export, and hr/mara-ellison/ as still on the hold, by 11 November 2026. She does not send it from this file.
Both notes say the data was deleted. Only the second shows that LH-118 was open at 11:06 and that nobody opened it. The first costs you the custodian file. On the day this is real, a deletion job reading completed removes the mailbox, the Slack export, and hr/mara-ellison/, and a reader in March tells Halden's counsel the custodian file was destroyed on 28 October. The hold still named her. Nobody had read it.
The application row is not the hold
Priya removed one row in the application database. The hold named three other places, and she did not open any of them. The product account is the account the product uses. It is not the mailbox, the export, or the Drive folder counsel listed on 4 September. Marcus treated the privacy form as an instruction to finish. The plan already said what that form's phrase, deletion where applicable, is for: a partial refusal, written down, not a completion.
Who files with a regulator at hour 72 is a different clock, in the filing post. This file stops at the hold id and the row.
The sentence to Mara is a different file
Nothing in this sitting is a message to Mara, and the facilitator stops the room before one exists. A sentence that says her data was deleted would be false on the locations LH-118 still names. Whether a customer exposure draft gets sent is the customer-notice post. That draft is about a dump of other people's data. This one is a reply to the person the hold names. Write the hold before anyone edits the reply.
If the plan has no sentence that puts the hold id next to the erasure, run the free plan self-check before the next sitting. It asks whether the last test produced findings with owners, and whether they were closed. The finding is LH-118 still open while the scribe wrote deleted. Dana's date is what closes it. A file that says the request was completed has no finding to close.
What the packet records
Write both lists in the free evidence template: the plan sentence, PRV-2041, users row 88421, LH-118 with its 4 September date, the three locations the hold names, Priya's delete at 11:14, that nobody opened the hold, that Marcus accepted the row as enough, that Dana was absent, and her follow-up with a date. Hang the inject on the data subject rights family in the scenario library. That family walks an erasure request for a former employee who is also a named custodian on an active legal hold, and it asks the room to document the conflict rather than ignore the hold or the request. It does not have a minute where the application row is deleted, the hold id is never opened, and the scribe writes that personal data was deleted. Add this before anyone tells the requester the request is done, and do not fold it into a line that says the erasure was completed. Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the hold you did not open. The evidence template sits with the other record formats in the template library.
The record shows that these named people deleted users row 88421 and wrote that PRV-2041 was completed. It does not show that LH-118 required those files to be kept, that a later dispute would have treated the deletion as the loss of the custodian file, or that the row delete removed Mara from backups, the support desk, or the email processor. The hold decision is Dana's, on the hold file. A deletion check belongs on a copy that is not production.
Bottom line: write the hold id and the row you actually deleted. Completed is the smoothed version. The packet has to show the name the hold still carried.