Dekimu · anchored receipts docs
ARR — Anchored Retention Receipts
Cryptographic proof of a data-lifecycle event — erasure, expiry, hold, anonymisation, or archive.
Purpose
An ARR records that a data-lifecycle event occurred: data was erased, a retention period expired, a legal hold was placed or lifted, or data was anonymised, pseudonymised, or archived. Each receipt is cryptographically bound to the policy in effect at the time of the event.
Batch receipts (ar.batch.v1) allow a single receipt to cover multiple records processed in the same operation, reducing issuance overhead while preserving verifiability.
Event types
| Kind | Label | Description |
|---|---|---|
ar.erasure.v1 | Erasure performed | Data permanently deleted. |
ar.expiry.v1 | Retention expired | Retention period elapsed. |
ar.anonymization.v1 | Anonymisation performed | Data rendered anonymous. |
ar.archive.v1 | Archive performed | Data moved to archive storage. |
ar.hold.v1 | Hold placed | Deletion suspended (legal hold). |
arr.hold_extension.v1 | Hold extended | Hold period prolonged. |
arr.hold_release.v1 | Hold released | Hold lifted, normal retention resumes. |
arr.pseudonymization.v1 | Pseudonymisation performed | Direct identifiers replaced. |
ar.batch.v1 | Batch event | Multiple retention events in one receipt. |
Key fields
retention_policy — reference to the retention schedule that governed the data. Includes policy ID, version, and the configured retention period.
legal_basis — the GDPR lawful basis (or equivalent) under which the data was held, and the basis for the lifecycle action (e.g. statutory obligation triggering the hold).
data_categories — array of data categories affected by this lifecycle event, aligned with Art. 9 special categories where applicable.
Regulatory context
ARR receipts address the storage-limitation principle in GDPR Art. 5(1)(e), which requires that personal data be kept no longer than necessary. Art. 17 (right to erasure) is evidenced by the ar.erasure.v1 event. Legal holds are common in litigation, regulatory investigation, and eDiscovery scenarios; the hold lifecycle events document the basis and duration of any departure from the standard retention schedule.