Why Data Deletion Should Not Be Executed by Privacy Software

This piece argues that privacy platforms should orchestrate—not execute—data deletion, advocating a human-in-the-loop model where source systems perform deletions natively. It warns of risks including failure to account for legal holds, referential integrity breakage, a centralized “global kill switch” attack vector, regulatory conflicts across jurisdictions, AI-driven false positives, and liability under the DPDP Act, and recommends a governance approach that flags, verifies, and requests safe deletions rather than automating irreversible actions.