Implementing individual rights
Your system must let the organization respond to requests within legal deadlines (generally 30 days): plan APIs and procedures, not ad hoc manual work.
| Right | Technical implementation |
|---|---|
| Access (s. 27 and 28) | JSON/CSV export of all of a person's PI, identity verification |
| Rectification | UI + update API, propagation to derived systems |
| Deletion / ceasing dissemination (s. 28.1) | Cascade deletion; procedure for backups and search indexes |
| Portability (since 2024-09-22) | Export in a structured, commonly used format (JSON, CSV) |
| Automated decision (s. 12.1) | Inform, explain, allow review by a person |
-- Cascade deletion: child tables reference users(id)
ALTER TABLE orders
ADD CONSTRAINT fk_orders_user FOREIGN KEY (user_id)
REFERENCES users(id) ON DELETE CASCADE;
Good practices
- A request register (date, type, outcome) to prove compliance.
- An inventory of systems containing PI, so nothing is forgotten during a deletion.
- Test the full deletion chain, including caches, logs and analytics copies.
Detailed legal framework: see the reference guide — Rights of data subjects.