My app has (or needs) a way for users to export their data and delete their accounts, and I want tests proving both do what my privacy policy claims. For data export: 1. Trigger an export for a fixture user with a realistic spread of data and assert the export contains all of it: profile, content, transactions, files or references to them. 2. Assert the export contains only that user's data. No other users' records, no internal fields (password hashes, internal flags, other tenants' IDs). 3. Assert the export format is actually usable (valid JSON/CSV that parses, files that open). For account deletion: 1. Delete a fixture account and assert the final database state: what's gone, what's anonymized, what's retained. 2. Compare the result against my privacy policy's claims. If the policy says data is deleted but records persist in plaintext, that's a finding: flag it. 3. Assert the deleted user can't log in, their sessions are dead, and their public content (if any) shows the intended tombstone state. 4. Assert related systems get the memo: billing is canceled (mocked provider), the user is removed from marketing lists if my stack has one. If my app doesn't have these flows yet, build the minimal versions first, then test them. Users and regulators both expect them. When finished, run the suite and summarize: export completeness, deletion completeness, and any gaps between policy and reality.