M9-01 GDPR — Right to Erasure / Data Disposal¶
Milestone: M9 — Hardening and Compliance
SOW Reference: NFR3
Requirement Clarity: ✅ Clear
Dev Status: ❌ Not started — time-based retention/purging exists (shared/services/retention-policy.service.ts), but user-initiated erasure does not
Overview¶
Let a Candidate (or Staffing Company on their behalf) request erasure of their personal data, per GDPR's right to erasure.
Backend Tasks¶
- Design an erasure workflow that cascades correctly across Candidate, CredentialOffer, disclosure, and audit-log records (weighing erasure against the immutable-audit-log requirement — these two NFR3 requirements are in tension and need a documented resolution, e.g. anonymisation instead of hard delete for audit trails)
- Add an erasure-request endpoint and processing job
Frontend Tasks¶
- Add an erasure-request action somewhere a candidate or admin can trigger it
Dependencies¶
- M9-01b logging reconciliation — the audit-log phased plan this needs to respect.
- M9-03 consent management — related GDPR surface, likely built together.
Acceptance Criteria¶
- Comply with GDPR, including data minimisation, subject access requests, and right to erasure (per SOW NFR3)
Existing Reference Material¶
Blockers & Risks¶
- Design tension: erasure vs. immutable audit logs needs an explicit resolution before building — likely anonymisation rather than deletion for audit records.
- New, 2026-08-26: Velocity's own CV Capture spec (M5-00) explicitly states the current operator API does not expose a presentation-deletion endpoint. Whatever erasure workflow this task builds cannot promise deletion of data disclosed to/stored by Velocity (depots, presentations) — only what lives in our own database. Scope the erasure guarantee accordingly, and flag this limitation to the client rather than implying full-platform erasure.