# Answer privacy requests

URL: /workflows/guides/answer-privacy-requests · Id: `guide:answer-privacy-requests`

> Say "answer privacy requests" and each one is verified, found across every System, acted on and confirmed within 30 days.

Each request to see, correct or delete someone's data is verified, answered across every [System](/business/nouns/system) and provider, and confirmed before the legal deadline. Missing a deadline is the expensive part, so the clock is tracked from the first message.

Needs: [Person](/business/nouns/person)

**Before it runs**

- You leave the chat: Never: it all happens in the chat.

## What you get
- 1 identity check on each requester before anything is shared (Person)
- 1 search for the Person’s records across every System and provider (Action)
- 1 export, correction or restriction, as asked (Consent)
- 1 confirmation to the Person before the deadline, kept on record (Message)
- 1 Task to the Legal Lead for any request at risk of running late (Task)

## Your agent does
**For agents**

- Guide: `guide:answer-privacy-requests`, status `live`. Page: [/workflows/guides/answer-privacy-requests.md](/workflows/guides/answer-privacy-requests.md).
- Approval: none. Run it when the founder asks.
- Leaves the chat: never.
- Needs first: [Person](/business/nouns/person).
- Run: call the steps in order, each through the API, SDK, CLI or MCP tab below; a later step passes the `$id` an earlier one returns. Each value marked example is the sample business’s: pass the founder’s own.

| Step | Verb | Inputs (type, required, this guide’s value) | Returns |
| --- | --- | --- | --- |
| 1 | [`Process.enable`](/business/nouns/process/enable) (`verb:Process.enable`) | `process` Process (an id), required: example `"process_privacy"` | `process` Process |
| 2 | [`Setting.update`](/business/nouns/setting/update) (`verb:Setting.update`) | `id` string, required: example `"setting_1"`; `key` string: example `"privacy.deadlineDays"`; `value` json: example `30` | `setting` Setting |

Returns: the last call answers with `setting` and its `action`, whose `status` is `done`, `pending` (waiting on an Approval or a Worker), `failed`, `canceled` or `refused`:

```json
{
  "api": "https://api.sb/leaseline.app",
  "setting": {
    "$id": "https://api.sb/leaseline.app/settings/setting_1",
    "$type": "Setting",
    "key": "privacy.deadlineDays",
    "value": 30
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/action_1",
    "operation": "Setting.update",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/action_1"
  }
}
```

Next: offer “Answer within 15 days for requests from the EU”, or “Copy my lawyer on every deletion”.

Calls: `Process.enable` → `Setting.update`

Ask:

```text
Answer privacy requests.
Someone asked us to delete their data.
Export everything we hold about this person.
```

API:

```bash
# 1. Process.enable
curl -X POST https://api.sb/leaseline.app/processes/process_privacy/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"

# 2. Setting.update
curl -X PATCH https://api.sb/leaseline.app/settings/setting_1 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":30,"key":"privacy.deadlineDays"}'
```

SDK:

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_privacy' })
await $.Setting.update({ id: 'setting_1', value: 30, key: 'privacy.deadlineDays' })
```

CLI:

```bash
npx startup-builder do Process.enable --json '{"process":"process_privacy"}'
npx startup-builder do Setting.update --json '{"id":"setting_1","value":30,"key":"privacy.deadlineDays"}'
```

MCP:

```json
{
  "name": "do",
  "arguments": {
    "code": "await $.Process.enable({ process: 'process_privacy' })\nreturn await $.Setting.update({ id: 'setting_1', value: 30, key: 'privacy.deadlineDays' })"
  }
}
```

## Change it
- Answer within 15 days for requests from the EU.
- Copy my lawyer on every deletion.
- Show me every request answered this year.

## Under the hood
- Systems: [Privacy](/systems/privacy), [Compliance](/systems/compliance)
- Nouns: [Person](/business/nouns/person), [Consent](/business/nouns/consent), [Thread](/business/nouns/thread), [Message](/business/nouns/message), [Setting](/business/nouns/setting)
- Events: `Thread.created`, `Consent.updated`

The [Privacy](/workflows/processes/privacy) [Process](/business/nouns/process) starts on each `Thread.created` from the privacy intake, with the [Privacy Officer](/agents/legal/privacy-officer) in the seat. A requester who cannot show who they are gets an answer that says why, and nothing is shared. Records are restricted, never erased, so the answer itself stays on record.