DSAR & Data Privacy

Data subject access requests and GDPR compliance

DSAR and Privacy

This guide covers how to manage Data Subject Access Requests (DSARs) and privacy rights within the platform, using the Compliance section of the Admin Console.

What Is DSAR?

A Data Subject Access Request (DSAR) is a right granted under the EU General Data Protection Regulation (GDPR). It allows individuals to exercise two key rights:

• Right of Access (Article 15) — individuals can request a copy of all personal data the platform holds about them.
• Right to Erasure / Right to be Forgotten (Article 17) — individuals can request that their personal data be permanently deleted.

The platform provides a built-in DSAR management workflow in the Admin Console to help platform administrators handle these requests in compliance with GDPR requirements.

Accessing the DSAR Interface

1. Open the Admin Console (port 3002).
2. Navigate to Compliance in the sidebar.
3. Select the DSAR tab.

The DSAR tab contains two sections: a form for creating new requests and a history table showing all previous requests.

Creating a Data Export Request (Article 15)

To create a data export request:

1. In the New Data Subject Request form, enter the User Email of the data subject.
2. Set the Request Type to "Export Data (Art. 15)".
3. Click Submit Request.

The request is created with a pending status and appears in the Request History table.

What Data Is Included in Exports

A data export collects all personal data associated with the user's email across the platform:

• Conversation history — all messages sent and received by the user across all agents.
• Agent interactions — tool calls, approval requests, and decisions associated with the user.
• Feedback submissions — any thumbs-up/down feedback and corrections the user provided.
• Memory data — short-term (Redis) and long-term (vector) memory entries linked to the user.
• Graph data — entity relationships in Neo4j extracted from the user's conversations.
• Audit events — all audit log entries where the user was the principal.
• Profile data — user identity attributes, group memberships, and role assignments.
• OAuth connections — metadata about connected integrations (provider names and scopes, not tokens).

Creating a Right to be Forgotten Request (Article 17)

To create an erasure request:

1. In the New Data Subject Request form, enter the User Email.
2. Set the Request Type to "Right to be Forgotten (Art. 17)".
3. Click Submit Request.

The request is created with a pending status. Erasure requests are displayed with a red "forget" badge in the Request History.

Executing Requests

Requests are not executed automatically upon creation. An administrator must explicitly execute them:

1. Find the request in the Request History table.
2. Click the Execute button (only available for requests in pending status).
3. The system processes the request:
   • For export requests: data is gathered, packaged, and made available for download. The status changes to completed and the number of entries affected is shown.
   • For forget requests: data is permanently deleted across all storage layers. The status changes to completed with the count of deleted entries.

Execution Status

Downloading Export Data

After an export request is completed:

• The entries affected count is displayed in the history table.
• Export data can be downloaded via the Admin API as a structured JSON package.
• The export includes all data categories listed above, organized by data type.

Right to be Forgotten: What Gets Deleted

When a "forget" request is executed, the platform permanently removes data from all storage layers:

The DSAR request record itself is retained for compliance audit purposes (documenting that the erasure was performed).

Request History

The Request History table shows all DSAR requests with the following columns:

Compliance Considerations

Response Timelines

Under GDPR, data controllers must respond to DSARs within one calendar month of receiving the request. The platform tracks creation dates to help administrators monitor compliance with this timeline.

Verification

Before creating a DSAR, administrators should verify the identity of the data subject through your organization's identity verification process. The platform does not perform identity verification automatically.

Lawful Basis for Retention

Some data may be exempt from erasure if there is a lawful basis for retention (e.g., legal obligations, legitimate interests). Administrators should consult their Data Protection Officer before executing forget requests that may conflict with retention requirements.

Audit Trail

All DSAR operations are logged in the platform's audit system:

• Request creation (who submitted, when, what type).
• Request execution (who executed, when, result).
• Data categories affected and entry counts.

This audit trail itself is retained even after a forget request, as it serves as evidence of GDPR compliance.

API Reference

All endpoints require admin role authentication and tenant context headers.

Related Guides

• Security and Compliance — broader compliance features including the compliance report
• Admin Guide — navigating the Admin Console