> A user has a long history of participating on your forum and other users have quoted their messages far and wide. Collectively all of the messages posted on y

> A user has a long history of participating on your forum and other users have quoted their messages far and wide. Collectively all of the messages posted on your forums (with or without timestamps) reveal a few PII about the user. Do you have to delete those? Technically yes. > The user filed a bug report about a functionality not working, do you have to delete the text of the bug report? Depends of the privacy policy of the bug tracking application. If it's stated that the report shouldn't contain any personal data you don't have to delete it. If the user asks for deletion stating that it contain personal data you have to delete it. > Arguably if your user table look like [user_id, creation_date, deletion_date, status, account_type] then this table does not contain any PII. It doesn't, as long you no longer have any way to associate user_id to the user personal data, you can keep it. > Sometimes users doxx themselves (like mistakenly sharing tax return forms instead cat pics), in such a case it is the user responsibility to signal this to you. In that situation if the user asks for deletion of the content you have to provide it. You are obviously not asked to monitor errors about the user.