Answer GDPR requests (access, rectification, erasure)

Your organization is the data controller. Administrators answer data subjects' requests in the console, under «Manage» › «Users» › «Privacy ↗» on the person's row. Each action asks for a recent confirmation, is audited and produces a receipt.

Access and portability

1. Choose «Export data (JSON)».
2. The file includes identity, authenticators (no secrets), sessions, phones, application sign-ins, third-party requests, privileged access data and up to 10,000 audit events about the person, without identifying other people.
3. With more events: the export is partial (10,000 events); repeat to continue from the oldest event.

The person can download their own data under «Protect» › «My data».

Email rectification

1. Type the address in «New email (the user confirms)» and choose «Request rectification».
2. «Request recorded. The user has 7 days to confirm with their passkey or Presence.»
3. «Cancel request» withdraws the proposal.

People managed by a directory are corrected at the source.

Erasure

1. Type the person's current email and choose «Delete (pseudonymize)».
2. Erasure is irreversible: it replaces the email, disables and freezes the account, ends sessions, revokes phones, erases device names and notes, cancels pending requests and destroys the key of privileged recordings not on legal hold.
3. The audit and signed receipts stay, in pseudonymous form.

You cannot erase your own account or the last active administrative account.

What the service does not do

It does not notify connected applications (OIDC, SAML, Microsoft 365). Correct or remove the account in each.

Deadlines

The GDPR generally expects an answer within one month. Checking the requester's identity and logging the requests are your organization's processes.