Skip to main content

Account deletion and the PDPA

Status: requirement recorded, not built. Checked 2026-07-25: the API has no account-deletion endpoint and no blocklist table. This page records the legal requirement and one suggested direction, so the requirement is not lost. Final design decisions belong on the Identities domain decisions page when the work is ratified.

Context​

Jod stores personal data for users in Singapore: name, email, mobile, government ID. Singapore's Personal Data Protection Act (PDPA) requires us to stop holding a person's personal data when they delete their account.

JodGig already follows this rule today: deleted user rows keep their id, but the personal-data columns are emptied.

The requirement​

  1. When a user deletes their account, remove the personal data from their row. Keep the row itself — rows are never hard-deleted (see the soft-delete convention in 90-99-engineering-meta/91-rails/schema/).
  2. A permanently suspended user must not be able to create a new account after deleting the old one. Deletion must not become a way to escape a suspension.

Direction (a suggestion, not a final design)​

Before wiping the row, hash the identifiers (email and mobile) with a one-way hash — for example SHA-256 with a salt — into a blocklist table. On every new signup, hash the submitted email and mobile the same way and check them against the blocklist. A match with a suspended user's hash rejects the signup.

This works because a one-way hash lets us recognise a returning identifier without storing any readable personal data.

Open questions for the team​

  • Does deletion also wipe the person's Talent::Profile and Org::Membership data, or only the identity row?
  • What happens to job-application history tied to a deleted account?
  • How long do blocklist rows live? Only suspended users, or everyone who deletes?