ANCHORED RETENTION RECEIPTS

Anchored Retention Receipts

Six wire types covering the full data retention lifecycle — scheduled expiry, subject-initiated erasure, legal hold, anonymisation, archive transition, and Merkle-batched bulk events. The data-lifecycle counterpart to ACR.

ARR · Shipped6 wire typesApache-2.0 · CC0 spec
← All familiesVerify a receipt →

WIRE TYPES

ar.erasure.v1

Records the execution of a data subject's right to erasure under Art. 17. Carries a trigger_receipt field linking to the withdrawal or subject-rights request that initiated it — anchoring the 30-day Art. 12(3) response window.

ar.expiry.v1

Records scheduled deletion after a declared retention period expires. Non-terminal — the chain remains open if further lifecycle events follow.

ar.hold.v1

Records a legal hold preventing deletion — compliance, litigation, or regulatory. Flips hold_active on the per-target chain. Reversible: a subsequent event can release the hold.

ar.anonymization.v1

Records anonymisation of personal data in place of deletion. Terminal event — the chain is closed for personal-data purposes once anonymisation is anchored.

ar.archive.v1

Records transition of data to long-term archive. The chain remains open if the archive lifecycle persists, allowing further retention events on archived data.

ar.batch.v1

Bulk-emission receipt carrying a state_snapshot_root Merkle root. Standalone — no prev chain. Used for periodic sweeps that affect many records at once.

WHAT IT PROVES

  • — Data was deleted, anonymised, archived, or held before a specific UTC date (Merkle inclusion proof).
  • — The retention event was issued by a registered system key (Ed25519 signature check).
  • — An erasure was executed within the 30-day Art. 12(3) window (trigger_receipt composition).
  • — The complete chain of lifecycle events for a given data target (per-target chain walk).

WHAT IT DOESN'T PROVE

  • — Data was actually removed from all backup systems and replicas.
  • — The anonymisation technique is irreversible under current or future methods.
  • — The legal basis for the original retention period was valid.
  • — The data subject's identity beyond a stable pseudonymous commit.

COMPOSES WITH

ARR receipts reference other family members via body-level composition pointers — verifier-coordinated, not signature-mandated.

ACRAnchored Consent Receipts

An ACR withdrawal may trigger an ARR erasure — the trigger_receipt field confirms the 30-day Art. 12(3) window.

ASRAnchored Subject-Rights Receipts

An ASR Art. 17 erasure request anchors the lifecycle; ARR anchors the execution. The pair forms the honoured-within-30-days proof bundle.

Verify any
ARR receipt.

verify.dekimu.com ↗

Paste any claim ID to verify a receipt, check its anchor, and inspect the issuer signature.

REFERENCES

GDPR Art. 5(1)(e) — Storage limitation principle (EUR-Lex) ↗
GDPR Art. 17 — Right to erasure (EUR-Lex) ↗
GDPR Art. 11 — Processing not requiring identification (EUR-Lex) ↗

Anchored Retention Receipts are cryptographic provenance and privacy-lifecycle protocols. verify.dekimu.com is a reference implementation, not a qualified trust service under Regulation (EU) No 910/2014 (eIDAS) or successor.