Privacy
Privacy answers every Person’s request about their data within the legal deadline.
Outcome
| Part | This Process |
|---|---|
| Outcome | Each privacy request is answered within its legal deadline, and the answer is on record. |
| Reads | Person, Thread |
| Leaves | File, Consent |
| On time | Within 30 days (calendar time); the clock stops while an Action waits on awaitingInput. Late Actions go to the Legal Lead. |
| Runs in | Each Startup |
Accountable
Workflows
| Workflow | Runs | Team |
|---|---|---|
| Privacy request | on Thread.created where intake = 'privacy-requests' | Legal Team |
Who does each step
| Workflow | Step | Role | Calls | Approval |
|---|---|---|---|---|
| Privacy request | 1. Verify the requester’s identity. | Privacy Officer | Person.get | None |
| Privacy request | 2. Find every record about the Person across every System and provider. | Privacy Officer | ||
| Privacy request | 3. Export, correct, or restrict the records as asked. | Privacy Officer | Consent.update | None |
| Privacy request | 4. Confirm completion to the Person before the deadline. | Privacy Officer | Message.create | None |
Events
| Direction | When | What happens |
|---|---|---|
| In | On Thread.created where intake = 'privacy-requests' | Starts Privacy request |
| Out | Consent.updated | Raised by step 3 of Privacy request |
| Out | Message.created | Raised by step 4 of Privacy request |
Plays
No Play names this Process.
Controls
- Breach notification
- Lawful basis
- Purpose limitation
- Retention restriction
- Privacy requests
- Disclosure record
- Records of processing
Settings
| Setting | Type | Default | Say | Set with |
|---|---|---|---|---|
privacy.deadlineDays | integer | 30 | Answer privacy requests within 30 days | Setting.update |
Failure
A failed step retries; when retries run out, the Action goes to the Legal Lead.
| Step | On failure |
|---|---|
| Privacy request 1. Verify the requester’s identity. | Times out after 7 days. Ends the Action failed. unverified: The requester cannot show who they are, so the answer says why. Continues at confirm. |
| Privacy request 3. Export, correct, or restrict the records as asked. | Goes to the Legal Lead. |
Loop
No loop: the path is never randomized, because it serves Privacy rights.
Code
Turn on privacyEnable
On by default for every Product Template. Process.pause stops new Actions; Actions in progress finish.
Answer privacy requests within 30 daysExample
A tutoring marketplace's Customer asks for a copy of her data. Privacy request verifies her identity, gathers her records from every System, and sends the export in 5 days, inside the 30-day deadline.