Deleting the data is cheap. Proving you deleted it isn't.

Ask most compliance teams what deletion costs and they’ll describe the technical step: find the record, run the delete, confirm the row is gone. That step is close to free. What actually drives the cost of a deletion request, according to Gartner’s widely cited estimate — reported at roughly $1,524 per manually fulfilled access or deletion request in DataGrail’s 2026 DSAR automation research — is almost entirely something else: the labor of proving it happened. Locating every system that might hold the record. Verifying the requester’s identity. Documenting each step. Producing something you could hand to an auditor or a regulator six months later and say, credibly, “here’s what we did, and when.” Deletion is a database operation. Proof of deletion is a paperwork operation, and it’s the one nobody budgets for correctly.

The evidence this is the actual gap, not a guess

This isn’t just an industry cost estimate — it lines up with what regulators are finding when they actually check. The EDPB’s own February 2026 report on right-to-erasure enforcement, based on a survey of 764 controllers across 32 EEA data protection authorities, found that the most common failure wasn’t botched deletions. It was the absence of any documented, repeatable procedure for handling erasure at all — meaning most surveyed organizations couldn’t have produced a credible audit trail even for requests they genuinely fulfilled. The technical capability to delete data and the organizational capability to prove it happened correctly are turning out to be two separate muscles, and most compliance programs have only built the first one.

What “proof” costs when the stakes get concrete

California’s Delete Act gives a useful, if extreme, illustration of what happens when proof-of-deletion becomes a hard, price-tagged obligation rather than a soft expectation. Enforcement of the state’s Delete Request and Opt-out Platform (DROP) reached its next phase in August 2026, with data brokers required to process a backlog of roughly 260,000 queued consumer deletion requests or face penalties of $200 per request, per day, until resolved — a structure where even one missed processing cycle at scale produces liability in the billions on paper. Starting in 2028, the law goes further and requires data brokers to undergo independent third-party audits of their deletion compliance every three years, with results reportable to the state’s privacy regulator on request. That’s the direction proof-of-deletion is heading generally, not just for data brokers: from “trust that it happened” toward “produce evidence that it happened, on a timeline, to a standard an outside party can check.”

What a defensible audit trail actually needs to contain

Stripped of any specific vendor’s implementation, a deletion record that could survive an actual audit needs a handful of things, generically, regardless of what system holds the data:

• A timestamped record of the request itself — when it arrived, through what channel, and what specifically was asked for. Without this, “we responded promptly” is an assertion, not a demonstrated fact.
• A record of which systems were checked, not just which record was found. Proving a negative — “this person’s data does not exist in system X” — matters as much as proving the positive, especially across an organization with more than one place personal data could live.
• Confirmation of completion, retained independently of the data itself. This sounds obvious and is the part most commonly missing: once the record is deleted, the only thing left to prove it happened is the log of the deletion — which means that log needs to be treated as a compliance artifact in its own right, not an incidental system message that rotates out in thirty days.
• A defined chain from request to confirmation that doesn’t depend on one person’s memory of a Slack thread. If the whole process only reconstructs from someone’s recollection, it isn’t an audit trail, it’s a witness — and witnesses are unavailable exactly when you need them, months or years later.

None of this requires exotic tooling. It requires treating the record of the deletion as something worth retaining as deliberately as the deletion itself is executed — which is a genuinely different budget line than “make sure the delete button works,” and the one most compliance programs still underfund.

Where this leaves a company running outreach

The takeaway for anyone processing deletion or erasure requests — cold outreach or otherwise — isn’t “delete data faster.” Most teams that get this wrong aren’t slow at deleting; they’re undocumented about it. The cheap fix is procedural, not technical: for every deletion or erasure request you handle, make sure the record of that it happened, when, and how it was verified survives at least as long as a regulator could plausibly ask about it — which, per this year’s enforcement patterns, is longer than most retention policies currently assume.

What that looks like when it’s built into the platform, not bolted on

This is the reasoning behind why Norbelys treats erasure as its own audited action rather than a flag on an ordinary delete. Calling people:erase doesn’t just scrub a contact’s PII — it logs the erasure as a compliance event with a timestamp, separately from the routine, reversible DELETE that archives a record without touching its data. That distinction is exactly the gap this year’s regulatory findings describe: an ordinary delete gives you “the row is gone,” which looks identical whether or not you can prove when it happened or that a repeatable procedure produced it. An audited erase gives you the second half — the record of that it happened, when, and under what request — without a separate paperwork process bolted on after the fact. The same logic extends to closing an account entirely: when an org deletes its account, Norbelys generates a final export snapshot automatically before the underlying data is torn down, with a signed download link emailed to the account owner — a dated artifact of exactly what existed right before deletion, rather than a bare assertion that “it’s been deleted” with nothing behind it if anyone asks later.