# Privacy

URL: /workflows/processes/privacy · Id: `process:privacy`

> Privacy answers every Person’s request about their data within the legal deadline.

Privacy answers every [Person](/business/nouns/person)’s request about their data within the legal deadline.

## Outcome
| Part | This Process |
| --- | --- |
| Outcome | Each privacy request is answered within its legal deadline, and the answer is on record. |
| Reads | [Person](/business/nouns/person), [Thread](/business/nouns/thread) |
| Leaves | [File](/business/nouns/file), [Consent](/business/nouns/consent) |
| On time | Within 30 days (calendar time); the clock stops while an Action waits on `awaitingInput`. Late Actions go to the [Legal Lead](/agents/legal/legal-lead). |
| Runs in | Each Startup |

## Accountable
[Legal Lead](/agents/legal/legal-lead), [Legal Team](/agents/legal).

## Workflows
| Workflow | Runs | Team |
| --- | --- | --- |
| [Privacy request](/workflows/processes/privacy/privacy-request) | on `Thread.created` where `intake = 'privacy-requests'` | [Legal Team](/agents/legal) |

## Who does each step

| Workflow | Step | Role | Calls | Approval |
| --- | --- | --- | --- | --- |
| [Privacy request](/workflows/processes/privacy/privacy-request) | 1. Verify the requester’s identity. | [Privacy Officer](/agents/legal/privacy-officer) | [Person.get](/business/nouns/person/get) | None |
| [Privacy request](/workflows/processes/privacy/privacy-request) | 2. Find every record about the Person across every System and provider. | [Privacy Officer](/agents/legal/privacy-officer) |  |  |
| [Privacy request](/workflows/processes/privacy/privacy-request) | 3. Export, correct, or restrict the records as asked. | [Privacy Officer](/agents/legal/privacy-officer) | [Consent.update](/business/nouns/consent/update) | None |
| [Privacy request](/workflows/processes/privacy/privacy-request) | 4. Confirm completion to the Person before the deadline. | [Privacy Officer](/agents/legal/privacy-officer) | [Message.create](/business/nouns/message/create) | None |

## Events
| Direction | When | What happens |
| --- | --- | --- |
| In | On `Thread.created` where `intake = 'privacy-requests'` | Starts [Privacy request](/workflows/processes/privacy/privacy-request) |
| Out | `Consent.updated` | Raised by step 3 of [Privacy request](/workflows/processes/privacy/privacy-request) |
| Out | `Message.created` | Raised by step 4 of [Privacy request](/workflows/processes/privacy/privacy-request) |

## Plays
No Play names this Process.

## Controls
- [Breach notification](/systems/trust-and-governance/controls/breach-notification)
- [Lawful basis](/systems/trust-and-governance/controls/lawful-basis)
- [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation)
- [Retention restriction](/systems/trust-and-governance/controls/retention-restriction)
- [Privacy requests](/systems/trust-and-governance/controls/privacy-requests)
- [Disclosure record](/systems/trust-and-governance/controls/disclosure-record)
- [Records of processing](/systems/trust-and-governance/controls/processing-records)

## Settings
| Setting | Type | Default | Say | Set with |
| --- | --- | --- | --- | --- |
| `privacy.deadlineDays` | `integer` | `30` | Answer privacy requests within 30 days | [Setting.update](/business/nouns/setting/update) |

## Failure
A failed step retries; when retries run out, the Action goes to the [Legal Lead](/agents/legal/legal-lead).

| Step | On failure |
| --- | --- |
| [Privacy request](/workflows/processes/privacy/privacy-request) 1. Verify the requester’s identity. | Times out after 7 days. Ends the Action `failed`. `unverified`: The requester cannot show who they are, so the answer says why. Continues at `confirm`. |
| [Privacy request](/workflows/processes/privacy/privacy-request) 3. Export, correct, or restrict the records as asked. | Goes to the [Legal Lead](/agents/legal/legal-lead). |

## Loop
No loop: the path is never randomized, because it serves [Privacy rights](/systems/legal-and-corporate/floor/privacy).

## Code

**Ask**

```text
Turn on privacy
```

**API**

```bash
curl -X POST https://api.sb/leaseline.app/processes/process_1/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_1' })
```

**CLI**

```bash
npx startup-builder do Process.enable --json '{"process":"process_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Process.enable({ process: 'process_1' })"
  }
}
```

## Enable
On by default for every Product Template. [Process.pause](/business/nouns/process/pause) stops new Actions; Actions in progress finish.

**Ask**

```text
Answer privacy requests within 30 days
```

**API**

```bash
curl -X PATCH https://api.sb/leaseline.app/settings/setting_1 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":30,"key":"privacy.deadlineDays"}'
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Setting.update({ id: 'setting_1', value: 30, key: 'privacy.deadlineDays' })
```

**CLI**

```bash
npx startup-builder do Setting.update --json '{"id":"setting_1","value":30,"key":"privacy.deadlineDays"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Setting.update({ id: 'setting_1', value: 30, key: 'privacy.deadlineDays' })"
  }
}
```

## Example
A tutoring marketplace's [Customer](/business/nouns/customer) asks for a copy of her data. [Privacy request](/workflows/processes/privacy/privacy-request) verifies her identity, gathers her records from every [System](/business/nouns/system), and sends the export in 5 days, inside the 30-day deadline.