Forgetmenaut

Intake & Request Normalization

Can you parse what DROP will send you?

Normalize email identifiers (lowercase, trimmed) Normalize phone numbers (non E.164 format) Normalize names (case + whitespace + special characters normalized) Normalize postal codes Normalize VINs Normalize CTV IDs Handle multiple identifiers per request (email + phone + address)

Identifier Hashing Compatibility

Is your hashing consistent and deterministic?

All identifiers normalized before hashing SHA-256 hashing consistent across ingestion, storage, and matching No mixed raw + hashed comparisons Encoding consistency (UTF-8, no hidden characters)

Data Source Coverage

Do you know where all your data lives?

Inventory of all data stores (databases, CSVs, SaaS tools, local downloads) Ability to query each source programmatically No orphaned datasets outside DSAR workflows Consistent identifier schema across sources Handling of historical / archived data

Matching & Resolution

Can you actually find the user?

Exact match coverage for all identifier types Multi-key matching (email OR phone OR address) Handling of partial or missing identifiers Match logging (what matched, where, why)

Deletion & Suppression Logic

Can you delete and prevent re-ingestion?

Deletion executed across all systems Suppression lists maintained and enforced Re-ingestion prevention Cascading deletes across linked records Verification that deletion succeeded

Downstream Propagation

Can you notify all data recipients?

Inventory of all downstream data recipients Accessible contract details for all downstream data recipients Ability to notify each recipient of deletion requests Tracking of notification status (sent, received, confirmed) Audit trail of downstream compliance Handling of non-responsive downstream partners

Auditability & Logging

Can you prove compliance under scrutiny?

Full request lifecycle logging Timestamped actions (intake, match, delete, notify) Audit trail of all actions and identities (users and systems) Evidence of downstream notification and receipt Retention of compliance records Exportable audit reports (individual and bulk) Exportable statistics for DROP and public reporting

Scale Readiness

Can you handle DROP volume?

System tested for 10x-100x request volume No manual steps in core workflow Queueing / retry mechanisms for failures SLA tracking for response deadlines Monitoring + alerting for backlog Mass outbound email capabilities without domain damage risk

Self-Assessment

< 20

High risk under DROP

20-30

Partial readiness

30+

Operationally prepared

DROP Readiness Checklist

Your Score