Secure data erasure framework using individualized encryption key management

A method comprising:

• detecting an account establishment of an account for an entity with a service provider, wherein the account establishment creates an account identifier (ID) for the account;
• generating an encryption key usable to encrypt data associated with the account;
• storing the encryption key with a data management service associated with a data removal platform, wherein the encryption key is stored with the data management service and the encryption key is not replicated outside of the data management service, and wherein the data removal platform manages removal of the data using the encryption key;
• encrypting the data using the data management service and the encryption key;
• receiving a data removal request of the data;
• determining the encryption key with the data management service;
• and
• erasing, by the data removal platform, the encryption key from key management service, wherein the erasing causes the encrypted data to become unreadable.

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

• determining data associated with an account that is stored by at least one database of a service provider is to be deleted, wherein the data was encrypted prior to storing by the at least one database using an encryption key associated with the account, and wherein the encryption key is required to decrypt the data to decrypted data;
• determining an account identifier (ID) for the account;
• identifying the encryption key used for the encrypted form of the data using the account ID from a key store, wherein the encryption key is stored by the key store associated with a data management service and not shared by the data management service for decrypting the data from the at least one database to the decrypted data;
• executing a key deletion process that deletes the encryption key from the key store;
• rendering the data unreadable based on executing the key deletion process;
• and
• generating pseudonymized text for the data that replaces at least a portion of the decrypted data that is unavailable after executing the key deletion process.