GDPR Compliance

The GDPR module gives your tenant a complete, audit-ready toolkit for data protection compliance. It covers consent lifecycle management, all seven data subject rights under Articles 15–22, breach notification workflows, Data Protection Impact Assessments, and the Article 30 Record of Processing Activities (ROPA).

All GDPR features require the admin:all permission. Access them from the sidebar under GDPR or via the API at /api/gdpr/*.

Overview

The module maps directly to the key obligations of the General Data Protection Regulation:

The module also supports 13 privacy regulations beyond GDPR, including UK GDPR, CCPA, LGPD, PIPL, and PDPA, tracked under the Regulations section.

Consent Management

Consent management covers two things: defining the types of consent your tenant collects, and recording individual user consent events against those types.

Consent Types

A consent type represents a specific, versioned consent purpose — for example, “Privacy Policy v3”, “Marketing Emails”, or “Analytics Tracking”. Each type has:

Creating a Consent Type

1. Go to GDPR → Consent Types and click New Consent Type.
2. Fill in the name, slug, category, and description.
3. Toggle Required if this consent is mandatory.
4. Click Save. The type is created at version 1 in draft state.

Publishing a Consent Type

Publishing a consent type bumps its version and marks all existing user consents against previous versions as stale. Users who have already consented will be prompted to re-consent the next time the consent check runs.

Consent Statistics

Go to GDPR → Consent Stats to see an acceptance and rejection breakdown per consent type. The stats show current version consent rates and can be used to identify consent types where re-consent rates are low after a version bump.

Recording and Revoking Consent

User consents are recorded as individual audit events. Each event captures:

• The user (userId)
• The consent type and the version at the time of consent
• Whether consent was granted or denied
• The IP address and user agent
• The timestamp of grant and, if applicable, revocation

Granting consent — Send a POST /api/gdpr/consents request with userId, consentTypeId, and granted: true. This is typically called server-side when a user accepts a policy form.

Revoking consent — Send a DELETE /api/gdpr/consents request with userId and consentTypeId. A revocation is recorded as a new audit event rather than deleting the original grant, preserving the full history.

Viewing the consent trail — GET /api/gdpr/consents?userId=<id> returns the full chronological consent history for a user, across all consent types.

Data Subject Access Requests (DSAR)

The DSAR module handles all seven rights under GDPR Articles 15–22:

DSAR Lifecycle

A DSAR moves through the following statuses:

RECEIVED → IDENTITY_VERIFICATION → IN_PROGRESS → AWAITING_INFO → COMPLETED
                                                                 → REJECTED
                                                                 → APPEALED

A deadline is automatically calculated when the request is created. Under GDPR the standard deadline is 30 days from receipt, extendable by two months for complex cases.

Creating a DSAR

1. Go to GDPR → Data Subject Requests and click New Request.
2. Fill in:
   • Subject name and email — the data subject’s identifying information
   • Type — one of the seven right types above
   • Priority — LOW, NORMAL, HIGH, or URGENT
   • Description — the subject’s request in their own words
3. Click Submit. The request is created with status RECEIVED and the deadline is set automatically.

Managing DSARs

From the DSAR list you can filter by status, type, and priority. Click any request to open the detail view.

Assigning a request — Set the Assigned To field to the team member responsible for handling it.

Identity verification — Before processing, advance the status to IDENTITY_VERIFICATION and confirm the subject’s identity. Set Identity Verified once confirmed.

Recording a response — Enter the response text in the Response field before marking the request complete.

Internal notes — Use the Internal Notes field for team-facing information that should not be shared with the data subject.

Rejecting a request — Set status to REJECTED and provide a rejection reason. Common grounds for rejection: the request is manifestly unfounded or excessive, or the data is required for legal claims.

Erasure Requests

Erasure requests implement the Article 17 right to deletion with a structured approval workflow. Unlike direct user deletion, erasure requests give administrators time to assess legal grounds for retention before committing to deletion.

Erasure Request Lifecycle

PENDING → APPROVED → PROCESSING → COMPLETED
        → REJECTED
        → CANCELLED

A grace period (scheduledAt) is set on approval to allow final checks before data is permanently removed.

Creating an Erasure Request

1. Go to GDPR → Erasure Requests and click New Erasure Request.
2. Enter the subject’s email address. Auris resolves the email to the internal user record automatically. If the user has never logged into the console but exists in the identity provider, a local record is created to anchor the request.
3. Provide a reason for the request.
4. Click Submit.

If a pending erasure request already exists for the same user, the submission returns an error. Resolve the existing request before creating a new one.

Approving or Rejecting

Open the request detail view and click Approve or Reject.

• Approve — Optionally set a scheduled execution date (grace period). The request moves to APPROVED.
• Reject — Provide a rejection reason. Common lawful grounds for refusal: the data is needed to fulfil a legal obligation, to defend legal claims, or the right of freedom of expression overrides the erasure request.

Executing Erasure

After approval, click Execute Erasure to begin data deletion. The request moves through PROCESSING to COMPLETED. The deletedData field is populated with a summary of what was removed.

Cancelling a Request

A PENDING request can be cancelled by the administrator (for example, if the data subject withdraws the request). This records a CANCELLED status with a timestamp.

Data Exports

Data exports implement the Article 20 right to data portability. When a data subject requests a copy of their data, you create an export job and provide them with the download link.

Creating a Data Export

1. Go to GDPR → Data Exports and click New Export.
2. Identify the user by entering either a user ID or email address.
3. Choose the export format: JSON (full structured data) or CSV (summary format).
4. Click Request Export.

The export job is created and processed asynchronously. Status moves from PENDING → PROCESSING → COMPLETED.

Export Statuses

Downloading and Sharing

Once the status is COMPLETED, the downloadUrl field contains a time-limited link. Send this link to the data subject directly. The link expires after the configured export retention period (default 7 days).

Data Breach Registry

The Data Breach Registry supports the Article 33 obligation to notify the supervisory authority within 72 hours of becoming aware of a breach, and the Article 34 obligation to notify affected individuals when the breach is likely to result in high risk.

Reporting a Breach

1. Go to GDPR → Data Breaches and click Report Breach.
2. Fill in the required fields:

3. Click Report. The breach is created with status DETECTED.

Breach Lifecycle

DETECTED → INVESTIGATING → CONTAINED → NOTIFIED_AUTHORITY → NOTIFIED_INDIVIDUALS → RESOLVED → CLOSED

Update the status as the incident response progresses. Record the following timestamps when they occur:

• Reported to Authority At — when you filed the Article 33 notification to the DPA
• DPA Reference Number — the reference assigned by the supervisory authority
• Reported to Individuals At — when you sent Article 34 notifications to affected individuals

Containment and Remediation

Update the Containment Actions and Remedial Actions fields as the incident progresses. These fields form part of your Article 33 notification record and may be requested by the supervisory authority.

If notification to individuals is not required (for example, because the data was encrypted and the risk to individuals is low), record the justification in the Notification Exemption Reason field.

Data Protection Impact Assessments (DPIA)

DPIAs are required under Article 35 when processing is likely to result in a high risk to individuals. The module lets you create, track, and archive DPIAs, and optionally link them to a specific processing activity.

DPIA Lifecycle

DRAFT → IN_PROGRESS → REVIEW → APPROVED
                              → REJECTED

Creating a DPIA

1. Go to GDPR → DPIAs and click New DPIA.
2. Fill in the title and description.
3. Optionally link the DPIA to a Processing Activity from your ROPA.
4. Click Save.

Completing a DPIA

A complete DPIA record includes:

Approving and Archiving

Once the DPIA is in REVIEW status, the approver can approve or reject it. On approval, approvedBy and approvedAt are recorded. Set nextReviewAt to schedule a periodic re-assessment.

DPO Dashboard

The DPO Dashboard provides an aggregated view of all GDPR module activity across the tenant, designed as a single starting point for the Data Protection Officer’s daily oversight.

Access it at GDPR → DPO Dashboard.

The dashboard surfaces:

The dashboard is read-only and reflects live data. It does not require navigating to individual sub-sections to get a health overview.

Compliance Readiness Checklist

The compliance readiness checklist provides an itemised view of GDPR obligations mapped to concrete checks. Each item references the relevant GDPR article and has a status and optional evidence field.

Checklist Item Statuses

Automated Checks

Some checklist items are automated. When you trigger Re-run Automated Checks (via POST /api/gdpr/compliance-readiness), Auris evaluates the tenant configuration and sets the status of automated items based on the current state. Examples of automated checks include: whether a retention policy is configured, whether a DPO contact is on record, and whether consent types are active.

Updating a Checklist Item

Click any item to open the edit panel. You can:

• Update the status manually
• Add notes explaining your approach
• Upload or link evidence (such as a document reference or URL)

Retention Policies

The retention policy is a tenant-level singleton that controls automatic data deletion. When the retention cron job runs, it enforces all configured retention periods across the tenant.

Configuring Retention

Go to GDPR → Retention Policy to view and update the policy.

Data Residency

The data residency record documents where your tenant’s data is physically stored and processed. It is used for DPO reporting, DPA inquiries, and customer data processing agreements.

Access it at GDPR → Data Residency.

Regulations

The Regulations section tracks compliance status across 13 global privacy frameworks. This is useful for tenants operating across multiple jurisdictions.

Supported Regulations

Regulation Statuses

Regulation Overview and Gap Analysis

Go to GDPR → Regulations → Overview to see a cross-regulation summary. The overview runs a gap analysis comparing your current configuration (consent basis, breach notification setup, DPO assignment, etc.) against the requirements of each active regulation and surfaces items that need attention.

Updating a Regulation Profile

Click any regulation in the list to open its detail view. You can update:

• Applicable regions (which countries this regulation applies to for your tenant)
• Consent basis used for this regulation
• Required breach notification window (in hours)
• Whether a DPO is required under this regulation
• Notes and review information

Processing Activities (ROPA)

The Record of Processing Activities satisfies the Article 30 obligation to maintain a written record of all data processing operations. Each entry in the ROPA represents a distinct processing activity.

ROPA Entry Lifecycle

Creating a Processing Activity

1. Go to GDPR → Processing Activities and click New Activity.
2. Fill in the required fields:

3. Click Save. The activity is created in DRAFT status.

Scheduling Reviews

Set the Next Review At date when creating or updating an activity. The DPO Dashboard surfaces activities whose review date has passed or is approaching.

Related Pages

• Logs & Compliance — Audit log and log streaming for GDPR data export and retention evidence
• Users & Roles — Managing individual users before or after erasure requests
• Session Management — Revoking sessions as part of an erasure or restriction workflow
• Security Settings — IP rules and attack protection that contribute to Article 32 technical measures