Saved more than $300K annually in vendor licensing by replacing the deletion workflow with an in-house API.
A deletion request touches every store that holds customer data. I marked a request complete only after each relevant system confirmed the deletion. The vendor workflow was expensive and put that legal obligation outside our control, so I built the replacement.
New stores and retention rules kept changing the work. I kept the business rules separate from storage, so changing an underlying system did not mean rewriting the core decision.
The rate-limited GDPR/CCPA services now run in every production environment. They process approximately 200K PII-based requests per month while preserving data residency and protecting production performance.
| Vendor cost | more than $300K annually |
| Deletion service | all production environments |
| Delivery | one month |
| Vendor dependency | removed from the request path |
What I'd do differently: I would define, validate, and version the data contract on day one. The first version relied too much on one system's document shape, which made subsequent changes harder to trace and validate.