The right to be forgotten, done with keys: erasure, legal hold and closure
Essence erases data by destroying the keys that read it and issues a certificate when erasure has run. An account-level legal hold pauses deletion, and only two named roles can lift it.
A person asks you to erase their data. At the same time, their account is part of a fraud investigation, and the sign-in history is evidence. One duty says delete. The other says keep. Many organisations meet this conflict with a manual process and a note on a file.
Essence handles each side with a mechanism of its own: erasure by destroying keys, and a legal hold that pauses deletion until two named roles agree to lift it. An organisation can honour both duties, and show afterwards what it did and why.
Erasure that does not depend on finding every copy
Under Article 17 of the GDPR, a person can ask for their data to be erased. The usual approach is to hunt down every row, file and copy and delete each one. Something is often missed: a replica, a search index, a backup.
Content in an Essence vault is encrypted on the person's device, and that pays off at the end of the relationship. Rather than chasing every copy of the encrypted content, Essence destroys the keys needed to read it. Once the keys are gone, the copies that remain are, by design, unreadable wherever they sit.
Erasure by key destruction was implemented in April 2026. One process coordinates the steps across the services involved and, at the end, issues a verification certificate. A person who asked to be forgotten can be shown that erasure ran. An organisation asked by a regulator what happened to someone's data can point to a certificate rather than an assurance.
When the law says wait
Sometimes data must not be deleted yet. A fraud investigation is the clearest case: removing a suspect account's sign-in history on schedule would destroy the evidence the investigation needs.
Essence has kept a register of legal holds on individual people since our August release. In our October release we added a hold on a whole account. While it is in force, routine deletion of that account's sign-in and device records is suspended in the services that hold them.
Nobody has to remember the hold for it to work. Scheduled clean-up carries on for everyone else, and stops only where a hold says it must.
Two roles to lift a hold
An account-level hold is released only when two named roles both sign: the fraud lead and the data protection officer. One person cannot release it. Two people in the same role cannot release it either.
That makes a hold easy to place and hard to lift by accident, which is the right way round. Placing a hold too early costs a little storage. Lifting one too early can cost an investigation, and nobody can undo that.
The two together
Go back to the person who asked to be forgotten while their account was under investigation. The organisation does not have to choose between ignoring the request and destroying evidence. The erasure waits while the hold is in force. Once both roles release the hold, the erasure completes by destroying the keys, and the certificate follows.
We are working towards account closure ending in the same place: the content and the keys to read it destroyed, unless a hold says otherwise.
What this means for your organisation
The useful question for an organisation is less "can you delete?" than "can you show what happened, and why something was kept?" A certificate answers the first. A hold that two roles must lift answers the second. If your organisation has to evidence erasure and retention under the GDPR, we would be glad to show you how the two fit your process.
Published 27 October 2026