Designing proof of deletion and audit trail UI in Figma: receipts, downstream jobs, and regulator-ready logs

Quick answer

Proof of deletion UI gives users and auditors verifiable evidence that data was erased—not just that a request was submitted. Design a deletion job tracker with per-system status, an immutable audit trail (who triggered what, when, and which legal basis applied), and a completion receipt (PDF or signed token) once downstream processors confirm. Start from the Figma guides hub and pair with erasure requests, consent withdrawal, compliance exports, audit log, and Dev Mode handoff.

---

Who this is for

• Product designers closing the loop on erasure UX after the request wizard ends.
• Privacy and compliance teams needing regulator-ready deletion evidence without manual spreadsheets.
• Engineering teams wiring multi-service deletion pipelines with observable status.

---

Deletion evidence hub (admin overview)

DeletionEvidenceHub — Acme App · 14 open jobs · 3 awaiting subprocessor ACK
├── Header: Completed this month 892 · Failed 2 · Avg completion 4.2 days
├── Actions: [ Export audit bundle ] [ Retry failed jobs ] [ Subprocessor SLA report ]
├── Tabs: Active jobs · Completed · Failed · Audit trail · Receipts
├── Alert: DEL-8821 · CRM delete failed · Retry 2/5 · Owner: platform-team
├── Filters: Request type · User ID · Scope · Legal basis · Date range · System
└── Link: [Erasure wizard](/designing-right-to-erasure-and-deletion-request-ui-in-figma/) · [DSAR portal](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/) · [Retention](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)

Section	Purpose
Active jobs	In-flight erasure with per-downstream status
Completed	Jobs with proof issued and retention of receipt metadata
Failed	Retry queue, escalation, and user communication templates
Audit trail	Immutable log of every deletion-related event
Receipts	Issued certificates linked to completed jobs

Verdict: Proof fails when the user sees “deleted” but backups or subprocessors still hold data—track every system explicitly.

---

User-facing deletion job tracker

DeletionTracker — Request DEL-8821 · Submitted 2026-08-10 · Status: In progress
├── Summary: "We're deleting your account data from our systems."
├── Progress bar: 4 of 6 systems complete
├── System rows:
│   ├── ✅ Primary database · Completed 2026-08-11 · job_db_441
│   ├── ✅ Object storage (avatars) · Completed 2026-08-11 · job_s3_882
│   ├── ✅ Email provider · Completed 2026-08-12 · job_mkt_019
│   ├── ⏳ Analytics warehouse · In progress · ETA 24h
│   ├── ⏳ CRM · Pending subprocessor confirmation
│   └── ⬜ Backup rotation · Scheduled after primary delete
├── Exceptions (if any): "Billing records retained 7 years per tax law" · Link [retention policy](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)
├── When complete: [ Download proof of deletion ] · Email confirmation
└── Support: [Contact privacy team] · Reference DEL-8821

Users need granular status, not a single spinner that disappears after 30 seconds.

---

Proof of deletion receipt

DeletionReceipt — DEL-8821 · Issued 2026-08-14
├── Header: Certificate of deletion · Acme App
├── Subject: User u_441 · Request submitted 2026-08-10 · Completed 2026-08-14
├── Scope deleted:
│   ├── Profile, preferences, content uploads
│   ├── Marketing identifiers and consent records (see [withdrawal](/designing-consent-withdrawal-and-downstream-deletion-ui-in-figma/))
│   └── Session and device tokens
├── Retained (legal exception):
│   ├── Invoice INV-9921 · Tax retention until 2033 · Basis: legal obligation
│   └── Fraud case FC-771 · Legal hold · Link [compliance exports](/designing-compliance-exports-and-legal-hold-ui-in-figma/)
├── Downstream confirmations:
│   ├── db_primary · ack_at 2026-08-11T14:02Z · hash a3f9…
│   ├── s3_media · ack_at 2026-08-11T14:05Z · hash b7c2…
│   └── crm_vendor · ack_at 2026-08-13T09:11Z · vendor_ref VND-441
├── Signature block: Issued by privacy-ops@acme.com · Receipt ID RCP-8821 · Verify at /privacy/verify/RCP-8821
├── Download: PDF · JSON (machine-readable) · Link [portability format](/designing-data-portability-and-machine-readable-export-ui-in-figma/)
└── Do not include: Remaining PII of other users · Internal system hostnames in user PDF

Receipts should be downloadable, verifiable, and scoped—not a generic “we processed your request” email.

---

Immutable audit trail entries

AuditTrail — Filter: deletion · Last 30 days
├── 2026-08-14T09:00Z · receipt_issued · DEL-8821 · actor: system · RCP-8821
├── 2026-08-13T09:11Z · subprocessor_ack · crm_vendor · job_crm_8821 · ack_ref VND-441
├── 2026-08-12T16:44Z · job_completed · analytics_warehouse · job_wh_771
├── 2026-08-11T14:05Z · job_completed · s3_media · objects_removed 42
├── 2026-08-11T14:02Z · job_completed · db_primary · tables: users, profiles, prefs
├── 2026-08-10T11:22Z · erasure_requested · user u_441 · scope: full_account · reauth: passkey
├── 2026-08-10T11:20Z · identity_verified · method: passkey · session s_882
└── Export: [Compliance bundle](/designing-compliance-exports-and-legal-hold-ui-in-figma/) · Immutable · No edit/delete in UI

Pair with security audit log patterns but separate privacy deletion events for clarity.

---

Downstream job orchestration (design reference)

System	Delete method	Proof signal	User-visible?
Primary DB	Hard delete + tombstone	Row count + timestamp	Yes
Object storage	Key purge	Object list hash	Yes
Search index	Document removal	Index refresh ack	Optional
Analytics warehouse	User ID pseudonymize or purge	Warehouse job ID	Yes
Email/CRM vendor	API delete contact	Vendor confirmation ref	Yes
Backups	Crypto-shred / rotation	Next rotation date	Yes (delayed row)
CDN cache	TTL expiry	Cache purge job	Usually hidden

Design failed-state rows with retry count and support escalation—not silent retries forever.

---

Admin failed-job recovery

FailedJob — DEL-8821 · CRM vendor · Error: 503 timeout · Retry 2/5
├── Impact: User tracker shows "CRM · In progress" · Do not issue receipt yet
├── Actions: [ Retry now ] [ Escalate to vendor ] [ Manual attestation ] [ Notify user delay ]
├── Manual attestation (rare): Upload vendor ticket · Legal sign-off · Creates audit entry
├── User comms template: "Deletion taking longer than usual · We will email when complete"
├── SLA breach: >30 days · Auto-escalate to DPO · Link [DSAR SLA](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/)
└── Never: Mark complete without ack · Hide failure from audit trail

---

Comparison: proof types by audience

Audience	Needs	UI surface
End user	Simple completion + PDF receipt	Deletion tracker + download
DPO / privacy team	Full job log + exceptions	Evidence hub
Regulator	Export bundle + ROPA link	Compliance exports
Subprocessor	API ack + reference ID	Vendor portal (out of scope—document in handoff)
Security	Tamper-evident log	Audit log integration

---

Handoff checklist (Dev Mode)

• DeletionJob — job_id, request_id, system_name, status, started_at, completed_at, error_code, retry_count.
• DeletionReceipt — receipt_id, request_id, scope_deleted[], scope_retained[], issued_at, verify_url, pdf_url.
• AuditEntry — event_type, actor, timestamp, request_id, metadata (immutable, append-only).
• SubprocessorAck — vendor_id, external_ref, ack_at, job_id.
• UserTracker — visible_systems[], progress_percent, completion_message, receipt_available.
• LegalException — retention_basis, data_category, expiry_date, link_to_policy.
• Accessibility — progress announced to screen readers; status not color-only; receipt download labeled.

---

Common mistakes

Mistake	Why it hurts	Fix
Instant “deleted” toast	Downstream still processing	Job tracker until all acks
No receipt after completion	User cannot prove erasure	Issue RCP-* certificate
Editable audit log	Regulator distrust	Append-only admin view
Receipt lists internal hostnames	Information leak	User PDF uses plain system names
Missing legal exceptions on receipt	Misleading proof	Explicit retained-data section
Same receipt for partial delete	Wrong scope	Scope-specific certificates
Failed job hidden from user	SLA breach surprise	Delay notification template
No verify URL	Receipt forgery concerns	Public verification endpoint design

---

Recommended workflow

1. Extend erasure wizard (erasure UI) with post-submit tracker link.
2. Map downstream systems from ROPA—one row per processor.
3. Design user tracker with per-system status and exception callouts.
4. Design receipt template (PDF + JSON) with scope, exceptions, and verify link.
5. Build admin evidence hub with failed-job recovery and export bundle.
6. Wire immutable audit trail—separate privacy deletion events from security log.
7. Test completion path in Dev Mode with mock job states.

---

FAQ

Is proof required for every erasure?

GDPR does not mandate a PDF, but documented completion helps demonstrate compliance—especially for DSAR and regulator inquiries.

What about consent withdrawal without full erasure?

Issue a narrow receipt for consent records and marketing identifiers deleted—not a full account certificate.

Link to legal hold?

Retained data must appear on the receipt with basis and expected retention end—never imply full deletion when hold applies.

Backup deletion timing?

Show scheduled backup rotation as a delayed row with expected date—users understand backups lag primary delete.

Regulator export?

Bundle receipts + audit trail + ROPA activity refs via compliance exports—one-click from evidence hub.

---

Next steps

• Design right to erasure and deletion request UI in Figma — request wizard that feeds the job tracker
• Design consent withdrawal and downstream deletion UI in Figma — partial deletion receipts
• Design compliance exports and legal hold UI in Figma — regulator bundles with deletion evidence
• Design audit log and security activity UI in Figma — tamper-evident event logging
• Design data retention policies and auto-deletion UI in Figma — exceptions shown on receipts