Designing right to erasure and deletion request UI in Figma: scope, exceptions, and proof of deletion

Quick answer

Right to erasure UI must let users request deletion with clear scope (profile only vs full account), show legal exceptions before confirmation, and track downstream jobs until proof of deletion is issued. Design a deletion request wizard with impact preview, identity re-auth, exception badges (legal hold, open invoice, fraud investigation), and an admin erasure queue with immutable completion receipts. Start from the Figma guides hub and pair with DSAR portal, consent withdrawal, data retention, compliance exports, and Dev Mode handoff.

---

Who this is for

• Product designers building account deletion, GDPR erasure, or “delete my data” flows in SaaS and consumer apps.
• Privacy and legal teams documenting when erasure can be delayed or partially denied.
• Engineering teams orchestrating deletion across databases, backups, analytics, and third-party processors.

---

Erasure request hub (admin overview)

ErasureHub — Acme App · 18 open requests · SLA 28 days · 2 legal holds blocking
├── Header: Overdue 1 · Partial erasure 4 · Full account delete 6 · Avg completion 11d
├── Actions: [ Review queue ] [ Exception templates ] [ Proof export ] [ Retention sync ]
├── Tabs: Open · In progress · Completed · Denied · Legal hold · Audit
├── Alert: REQ-4412 · User u_882 · Legal hold on invoice dispute · Cannot complete until lifted
├── Filters: Scope (partial|full) · Region · Reason · Processor backlog · Status
└── Link: [DSAR portal](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/) · [Legal hold](/designing-compliance-exports-and-legal-hold-ui-in-figma/) · [Retention](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)

Section	Purpose
Open	New requests awaiting triage and identity verification
In progress	Downstream deletion jobs running across systems
Completed	Proof-of-deletion receipts issued to the user
Denied	Documented exceptions with appeal path
Legal hold	Requests blocked until hold expires or is released
Audit	Immutable log for regulators and internal review

Verdict: Erasure fails when “Delete account” hides legal exceptions until after confirmation—surface scope and blocks before the user commits.

---

Deletion scope registry

ErasureScopeRegistry — User-selectable scopes · 5 tiers
├── profile_and_preferences
│   ├── Deletes: name, avatar, bio, notification prefs · Keeps: billing history (legal obligation)
│   ├── Downstream: CRM contact anonymized · Marketing lists suppressed
│   └── SLA: 7 days · Auto-approve if no open disputes
├── activity_and_content
│   ├── Deletes: posts, comments, uploads · Keeps: audit trail hashes (pseudonymized)
│   ├── Downstream: CDN purge · Search index removal · Backup TTL 30d noted
│   └── Link [anonymization](/designing-anonymization-and-pseudonymization-controls-ui-in-figma/) for retained aggregates
├── marketing_and_analytics
│   ├── Deletes: ad IDs, event history in product analytics · Not the same as [cookie consent](/designing-cookie-consent-and-tracking-preference-ui-in-figma/) withdraw
│   ├── Downstream: Segment delete · Ad partner opt-out API
│   └── Pairs with [consent withdrawal](/designing-consent-withdrawal-and-downstream-deletion-ui-in-figma/) for consent-based processing
├── full_account_delete
│   ├── Deletes: login, all scopes above · Cancels subscription at period end or immediately per policy
│   ├── Blocks: Open chargeback · Active legal hold · Org owner with active seats
│   └── Re-auth required · Type email or "DELETE" confirm
└── processor_only_erasure
    ├── User cannot trigger · Admin-initiated after subprocessors breach
    └── Links [DPA hub](/designing-data-processing-agreements-and-subprocessor-management-ui-in-figma/) processor list

One screen should not mix “delete my posts” and “close my account” without explicit scope selection.

---

Customer deletion wizard (step flow)

ErasureWizard — Step 1 of 4 · Choose what to delete
├── Options:
│   ├── ○ Delete my profile and preferences only
│   ├── ○ Delete my activity and uploaded content
│   ├── ○ Stop marketing and delete analytics tied to me
│   └── ○ Delete my entire account and sign-in
├── Impact preview (dynamic):
│   ├── "You will lose access to Team Alpha · Transfer ownership first" · Link org billing
│   ├── "Invoice INV-9921 is in dispute · Full delete blocked until resolved"
│   └── "Backups may retain data up to 30 days per [retention policy](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)"
├── Step 2: Reason (optional) · Helps product · Not required for valid request
├── Step 3: Re-authenticate · Password · 2FA · [Session timeout](/designing-session-timeout-and-re-authentication-ui-in-figma/) if stale
├── Step 4: Confirm · Checkbox "I understand this cannot be undone" · Type DELETE for full account
└── Submit: Creates erasure_request_id · Email confirmation · Link to status tracker

Impact preview is mandatory—users must see what breaks before confirming.

---

Exception and partial denial UI

ErasureException — REQ-4412 · Full account delete · Blocked
├── User message: "We can't delete your account yet because of an open billing dispute."
├── Exception chips: Legal obligation · Open invoice · Retention until 2026-09-01
├── What we can do now:
│   ├── [ Delete marketing data ] · Available immediately
│   ├── [ Export my data ] · [Portability](/designing-data-portability-and-machine-readable-export-ui-in-figma/)
│   └── [ Rectify billing email ] · [Accuracy rights](/designing-data-accuracy-and-rectification-rights-ui-in-figma/)
├── What happens next: We'll complete erasure within 30 days of dispute close · Email when unblocked
├── Appeal: [ Contact privacy team ] · Reference REQ-4412 · SLA clock documented
└── Admin: Link legal hold record · [Compliance export](/designing-compliance-exports-and-legal-hold-ui-in-figma/) bundle

Denials need specific reasons and partial alternatives—not a generic “contact support.”

---

Downstream deletion job tracker (user-facing)

ErasureStatus — REQ-4488 · Full account delete · Submitted 2026-08-10
├── Overall: In progress · 4 of 6 systems complete · Est. completion 2026-08-17
├── Jobs:
│   ├── ✅ Primary database · user row pseudonymized · Completed 2026-08-11
│   ├── ✅ Object storage · 142 files removed · Completed 2026-08-11
│   ├── ⏳ Search index · Propagation 24–48h · In progress
│   ├── ⏳ Analytics warehouse · Partner API pending · In progress
│   ├── ○ Backup rotation · Scheduled purge day 30 · Pending
│   └── ○ Email to user · Proof receipt · Pending
├── Cannot cancel after step 3 · Support link for mistaken request within 1h grace (if offered)
└── Completed state: Download [proof of deletion PDF] · Confirmation email copy

Users trust erasure when they see system-by-system progress, not a silent spinner.

---

Proof of deletion receipt

DeletionReceipt — REQ-4488 · Completed 2026-08-17
├── Summary: Full account delete for user@example.com · Request ID REQ-4488
├── Scope completed: profile, activity, marketing, authentication
├── Exceptions retained (if any): Pseudonymized billing record INV-9921 · Legal basis: tax law · Until 2031
├── Systems attested: db_primary, s3_assets, search, segment, auth0 · Backup TTL noted
├── Certificate hash: sha256:def… · Issued 2026-08-17T14:22Z
├── User actions: [ Download PDF ] [ Email copy ] · No re-login if account deleted
└── Admin: Immutable store · [Audit log](/designing-audit-log-and-security-activity-ui-in-figma/) entry · Regulator export

Receipts support DSAR closure and audit evidence without exposing other users’ data.

---

Comparison: erasure vs related rights

Right	User goal	UI emphasis	Typical SLA
Erasure (Art. 17)	Delete personal data	Scope, exceptions, proof	30 days
Withdraw consent	Stop future use	Downstream stop, not always delete	Immediate–72h
Portability (Art. 20)	Get a copy	Export formats, not deletion	30 days
Rectification (Art. 16)	Fix inaccurate data	Edit forms, propagation	30 days
Restrict processing (Art. 18)	Freeze use, keep data	Banner + limited features	Immediate
Account deactivate	Pause access	Reversible · Not GDPR erasure	Instant

Do not label deactivate as “delete my data” without clarifying reversibility.

---

Handoff checklist (Dev Mode)

• ErasureScope — scope_id, data_categories[], systems[], retention_exceptions[].
• ErasureRequest — request_id, user_id, scope_id, status, submitted_at, sla_due_at, reason_optional.
• ErasureBlock — block_code, user_message, partial_actions[], unblock_condition.
• DeletionJob — job_id, system_id, status, started_at, completed_at, error_code.
• DeletionReceipt — receipt_id, request_id, scope_completed[], exceptions[], certificate_hash.
• ReauthGate — required_for_scopes[], methods[], grace_period_minutes.
• Accessibility — impact list readable; confirm not color-only; focus order through wizard.

---

Common mistakes

Mistake	Why it hurts	Fix
Single “Delete” with no scope	Wrong data removed or invalid denial	Scope registry + wizard
No legal exception before confirm	Trust breach + compliance risk	Impact preview with chips
Instant “done” with no job tracker	User assumes backups deleted	System-level status
Erasure = marketing unsubscribe	Art. 17 vs consent confusion	Separate flows
No proof receipt	Cannot close DSAR or defend audit	PDF + immutable hash
Org owner delete without transfer	Team data orphaned	Block + billing handoff
Grace period hidden	Irreversible mistakes	1h cancel if technically feasible
Special category without Art. 9 path	Invalid erasure of health data	Link special category consent

---

Recommended workflow

1. Map data stores in ROPA before designing delete scopes (ROPA UI).
2. Design scope wizard with impact preview and re-auth for full account delete.
3. Document exception templates with legal review—billing, fraud, legal hold.
4. Build admin erasure queue synced with DSAR portal if unified inbox.
5. Wire deletion jobs per system with user-visible progress.
6. Issue proof receipts and log in audit trail.
7. Align retention—backups and legal holds must appear in receipt exceptions (retention UI).

---

FAQ

Same as consent withdrawal?

Withdrawal stops future processing; erasure removes existing personal data where no exception applies. UI can link both from privacy settings.

How does legal hold interact?

Hold blocks erasure for scoped records—show hold reason, expiry, and partial delete options.

B2B org admin deletes employee?

Workplace erasure differs—separate admin flow; do not reuse consumer account wizard without HR/legal review.

US state delete laws?

Many mirror right to delete—reuse scope wizard; map exception labels per region badge.

Mistaken deletion request?

Optional short grace window + support ticket with request_id before jobs become irreversible.

---

Next steps

• Design data subject access request and GDPR portal UI in Figma — unify erasure with access and portability
• Design consent withdrawal and downstream deletion UI in Figma — stop processing before full erasure
• Design data retention policies and auto-deletion UI in Figma — backup TTL and scheduled purge
• Design compliance exports and legal hold UI in Figma — exceptions that block erasure
• Design privacy settings and data management UI in Figma — entry point for all data rights