Answer privacy requests

Each request to see, correct or delete someone's data is verified, answered across every System and provider, and confirmed before the legal deadline. Missing a deadline is the expensive part, so the clock is tracked from the first message.

Needs Person

What you getCopy Anchor Link

• 1identity check on each requester before anything is sharedPerson
• 1search for the Person’s records across every System and providerAction
• 1export, correction or restriction, as askedConsent
• 1confirmation to the Person before the deadline, kept on recordMessage
• 1Task to the Legal Lead for any request at risk of running lateTask

Your agent doesCopy Anchor Link

# 1. Process.enable
curl -X POST https://api.sb/leaseline.app/processes/process_privacy/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"

# 2. Setting.update
curl -X PATCH https://api.sb/leaseline.app/settings/setting_1 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":30,"key":"privacy.deadlineDays"}'

import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_privacy' })
await $.Setting.update({ id: 'setting_1', value: 30, key: 'privacy.deadlineDays' })

npx startup-builder do Process.enable --json '{"process":"process_privacy"}'
npx startup-builder do Setting.update --json '{"id":"setting_1","value":30,"key":"privacy.deadlineDays"}'

{
  "name": "do",
  "arguments": {
    "code": "await $.Process.enable({ process: 'process_privacy' })\nreturn await $.Setting.update({ id: 'setting_1', value: 30, key: 'privacy.deadlineDays' })"
  }
}

Change itCopy Anchor Link

• Answer within 15 days for requests from the EU.
• Copy my lawyer on every deletion.
• Show me every request answered this year.

Under the hoodCopy Anchor Link

Systems

Privacy, Compliance

Nouns

Person, Consent, Thread, Message, Setting

Events

Thread.created, Consent.updated

The Privacy Process starts on each Thread.created from the privacy intake, with the Privacy Officer in the seat. A requester who cannot show who they are gets an answer that says why, and nothing is shared. Records are restricted, never erased, so the answer itself stays on record.