A User Consent Framework for Privacy-Aligned Data Deletion in Retail Solutions

Abstract

In the digital age, businesses gather and keep enormous volumes of user data, frequently requiring the explicit consent of the user for processing and storage. However, it is still exceedingly difficult to guarantee total data erasure upon consent revocation, especially in systems that have disaster recovery databases and synced data centers. The Consent-Driven Data Erasure System presented in the paper is intended to solve this problem by enabling the automated deletion of sensitive and personal data upon user revocation of consent. MS SQL Server is used to create the suggested system, where sensitive information, including payment details, is kept in a separate Consented Data Table and user registration details are kept in a Login Table. Personal information is stored in the consented table automatically when a user registers and accepts the terms and conditions. The solution guarantees total and irreversible data erasure by deleting all associated data from both the primary data center and the disaster recovery database when users withdraw their consent. In order to accomplish this, we implement stored procedures and database triggers that control ongoing synchronization and deletion operations. In order to address concerns about unlawful data retention, the system makes sure that privacy laws like the GDPR and the Digital Personal Data Protection (DPDP) Act are followed. Our findings show that this strategy minimizes privacy threats, improves user control over personal data, and creates a strong foundation for consent-based data lifecycle management in digital platforms.