GDPR Erasure Is Not DELETE FROM users

When a parent on our school platform submits a deletion request, an administrator approves it, and our server runs one function — anonymiseContact($contactId) . That function took five attempts to get right. This post is about what makes Article 17 of the GDPR (the "right to erasure") genuinely difficult to implement, the decision tree we eventually settled on, and the specific failure modes we hit along the way. The code is Laravel and Postgres, but the decisions are universal. The naive implem