Proof of Absence: What to Ask For When You Want Your Data Actually Gone

In most SaaS tools, deleting an account takes about four seconds. You click the button, confirm the dialog, maybe type the word DELETE for good measure. The screen refreshes and the record is gone. It feels final.

It usually isn't. An account vanishing from your dashboard is not the same as personal data vanishing from the supplier's estate. Between the live application and the backup tapes there is a lot of middle ground, and that gap is where small UK teams get caught out. You do not need a legal department to close it. You need a map, a specific request, and a receipt.

The button is a UI event, not an outcome

A delete button typically removes the record from the live application. Sometimes it soft-deletes: the row stays, flagged as inactive, waiting for a retention window to pass. Sometimes it moves the record to a recycle bin that nobody empties. None of that tells you what happened to the copy in the analytics warehouse, the attachment in a support ticket, the email address in a marketing suppression list, or the queue at a subprocessor.

Under UK GDPR, erasure is a right with conditions, not a magic trick. You are allowed to ask where the data sits and what evidence the supplier will provide when it is gone. That is a normal procurement conversation, not an accusation.

Map the copies before you ask

Before you send anything, spend fifteen minutes listing the places data tends to survive. For a typical small-team SaaS product, that means:

• the live application database and any soft-delete or recycle-bin layer;
• backups and disaster-recovery snapshots, which often run on a separate cycle;
• analytics, BI or data-warehouse copies used for reporting;
• application logs, error trackers and security monitoring tools;
• support desks, where attachments and email threads can outlive the account;
• marketing and CRM systems, including suppression lists that keep an email address to honour an opt-out;
• subprocessors, from hosting providers to email delivery services.

You do not need to audit every one of these yourself. You need to know they exist so your request is not naively narrow. Asking a vendor to "delete my data" when you mean "delete the customer record but keep the invoice for HMRC" invites a vague answer.

Make the request specific enough to answer

A useful erasure request names the data subject or account, the categories of data in scope, the systems you expect to be covered, and the date you want it done. For example: the account for a named user, including contact details, usage records and uploaded attachments, across the production application, analytics and support tools. Ask for written confirmation and a named contact. Reference the contract and, if it helps, Article 17 of UK GDPR. Keep the tone practical. You are asking for a receipt, not filing a claim.

It also helps to ask two follow-up questions in the same message: what will be deleted from backups, and on what timeline? Many vendors will confirm live deletion within days but backup deletion within a stated window, often thirty to ninety days. That is a reasonable answer. Silence is not.

The exceptions that keep data alive

Some data will survive an erasure request, and that can be lawful. Tax and accounting rules may require invoice records to be kept. A contract in force may justify retaining limited transaction data. Legal claims, fraud prevention and security incident logs can also provide a basis for keeping a minimal record. Vendors will often retain a small note that an erasure request was made and fulfilled.

The point is not to demand zero retention. The point is to get the vendor to say what they kept, why, and for how long. A confirmation that lists the carve-outs is more useful than a blanket assurance that everything is gone, because the blanket assurance is rarely true.

The receipt that survives a supplier change

Save the confirmation outside the vendor's own portal. A PDF plus a plain-text copy in your own document store is enough. Make sure it includes:

• the vendor's legal entity and trading name, not just the product brand;
• the product and account or tenant identifier;
• the date of your request and the date of confirmation;
• the scope: data categories, systems and subprocessors covered;
• the backup deletion timeline and any retention exceptions with their basis and end date;
• the name or role of the person confirming, and a ticket reference.

That last set of details matters more than it looks. Suppliers get acquired, renamed and folded into parent companies. A receipt that names only a logo can become orphaned in two years. A receipt that names the legal entity and the product still makes sense when the branding changes.

A small test you can run this month

Pick one tool that holds customer or staff personal data. Ask the supplier three questions: where copies of deleted data live, what a specific erasure request should contain, and what written confirmation they provide. Then update your offboarding checklist so the next leaver or cancelled account triggers a proper request rather than a hopeful click.

A deletion button is a start. A receipt is the end. Keep both.