The Utility of Deleting Things

I remember the first few years of SOX, back when every mid-level manager thought a control meant printing out a spreadsheet and signing it in blue ink. It was theater. They weren't managing risk; they were managing the auditor. We’ve spent two decades trying to move past that, yet here we are in 2026, still seeing organizations treat their data retention policies as optional suggestions rather than hard controls.

The most serious action this week involves a UK data breach that exposed just over 25,000 Afghans to potential Taliban reprisals. The inquiry found the system failure was "foreseeable."

Read that again. Foreseeable.

In my world, foreseeable is another word for "you ignored the red flags during the design phase." When a finding describes a failure as foreseeable, it means the control wasn't just broken—it was probably nonexistent or fundamentally flawed from the start. This isn't a case of a sophisticated hacker bypassing a perimeter; this is a basic failure of data hygiene.

The organization got the most fundamental part of the lifecycle wrong: the end. They kept data they no longer had a legal or operational justification to hold. In any halfway decent control environment, the "Dispose" phase of the data lifecycle is just as critical as the "Collect" phase. If you aren't purging sensitive records on a strict, automated schedule, you aren't running a security program. You're running a digital museum of future liabilities.

The control should have been a hard-coded retention trigger. I don’t want to hear about a policy document that says "records shall be deleted after X years." Policies are for people who like reading PDFs. A real control is a script that runs every Sunday at 2:00 AM, identifies records past their expiry date, and wipes them from the production environment and the backups. If the system doesn't allow for automated purging, you don't put high-risk data into it. Period.

Now, let's talk about what this costs you at year-end.

Usually, I’m calculating the cost in terms of a regulatory fine or a plummeting share price. In this instance, the cost is far more visceral and permanent. When you expose 25,000 people to physical reprisals, the "cost" isn't just a line item on a balance sheet. It's an absolute collapse of institutional trust and a political nightmare that will haunt every subsequent audit for a decade. For the executives involved, the cost is their reputation as competent stewards of public safety.

The inevitable objection here is the "Legacy System" excuse. I’ve heard it since 2003. "Gordon, we can't just delete the data because the old database architecture doesn't support granular purging without breaking the rest of the schema."

My answer is simple: if your system is too fragile to allow you to delete data, it is too fragile to hold sensitive data. You don't get a pass on risk because your software is old. If you can't purge, you migrate. If you can't migrate, you encrypt the data and throw away the key for anything past its retention date. Anything else is just choosing to be vulnerable.

The second-order effect here is where this gets interesting for the rest of us. The regulator isn't going to stop with one agency. When a "foreseeable" failure leads to this level of catastrophe, it triggers a contagion of audits. Every government body and NGO holding high-risk lists—witnesses, dissidents, refugees—is now in the crosshairs. The ICO and other watchdogs will be looking for exactly this kind of hoarding. They’ll be asking why data from five years ago is still sitting in a plaintext field in some forgotten SQL server.

If you're an auditor or an insurer covering these entities, your risk profile just shifted. You can no longer accept a "retention policy" as evidence of a control. You need to see the logs of the deletions actually happening. You need to see the void where the data used to be.

We've spent too long pretending that more data equals more value. In a compliance context, every byte of unnecessary data is just a liability waiting for a date. The most effective security control ever invented isn't a firewall or a zero-trust architecture.

It's the delete key.