# What the compiler checks

- **Marked fields nothing reads.** A personal field that no query, output
  or action reads is an error, because you are holding data you don't use
  (data minimisation, Article 5). You can
  [decline](declining-a-judgement-call.md)
  it, with a reason, because a field kept for a legal reason may be read
  only by export.
- **Erasure is complete.** Every reference into a person's records has an
  erasure outcome. `Erasure.anonymised` and `Erasure.retained` have the
  nullable fields and retention they need.
- **No personal data erasure can't reach.** A marked field on an entity
  that isn't a person, and doesn't belong to one through references, is a
  compile error: "erasure cannot find this: reference the person, or mark
  the entity `person: true`". With the completeness check above, every
  stored copy of personal data can be reached.
- **Sensitive fields stay out of caches.** A cache on an entity that holds
  one leaves those fields out.

There is no `purpose:` setting and no consent model in the language.
Purposes and lawful bases belong in your privacy notice, which you write
from the report. Consent is ordinary application data, such as a `Consent`
entity holding the purpose and when it was given and withdrawn.