The DPDP Erasure Paradox: Why "is_deleted" is Illegal and SQL "DELETE" is Broken.

Short summary

Under India's DPDP Act 2023, soft-delete patterns (is_deleted flag) violate mandatory data erasure requirements, while hard-delete breaks conflicting financial retention laws. A Control Plane/Data Plane architecture with Vault-and-Mask operations solves this paradox: encrypting and isolating PII in a secure vault for audit compliance while applying cryptographic hashing to active records, simultaneously satisfying DPDP erasure and audit retention mandates.

• •DPDP Act 2023 mandates immediate erasure; financial retention laws require preservation—creating an architectural paradox
• •Control Plane (public API) coordinates policy; Data Plane (private worker) executes safely with zero production credentials
• •Vault-and-Mask operation encrypts identity and applies cryptographic hash, satisfying both DPDP erasure and financial audit requirements

Generated with AI, which can make mistakes.