Audit and GDPR

In this tutorial, we search the audit log, copy events for an investigation, and answer data-subject requests under the GDPR. Under Operate, Audit, you see the organisation's security events: sign-ins, settings changes, phones, approvals and application sign-ins. Events can't be edited or deleted, and they store identifiers, not names or emails. Filter by event type, by outcome, by actor or subject, and by dates.

Then choose Apply filters. For an investigation, choose Create JSON copy, and confirm with your passkey or phone. Up to ten thousand events are copied. The copy is sensitive: keep it somewhere protected. Every event joins a chain of cryptographic digests, in the same transaction. And approvals are covered by signed receipts. Under the GDPR, the organisation is the controller.

Data-subject requests are handled under Manage, People, Privacy, on the person's row. Each action asks for a recent confirmation, is audited and produces a receipt. For access and portability, choose Export data. The file includes the identity, the authenticators without secrets, sessions, phones and the audit trail about the person. The person can also download their own data.

To correct the email, type the new address and request rectification. The person has seven days to confirm with their passkey or phone. Erasure is irreversible: it replaces the email, freezes the account, ends sessions and revokes phones. The audit trail and receipts remain, in pseudonymous form. Connected applications aren't notified: fix the account in each one.

As a rule, answer within one month. And that's it: an audit trail that can't be rewritten, and GDPR requests handled with proof. Thank you for following these tutorials.