Privacy Rights Automation FAQs
Common questions about DSAR automation and privacy rights management in Salesforce.
What is a DSAR and how does Privacy Rights Automation handle it?
A Data Subject Access Request (DSAR) is a formal request from an individual to access, correct, or delete their personal data. The system manages the entire lifecycle including intake forms, identity verification, automated data discovery across Salesforce objects, execution of exports or deletions, and compliance documentation with timestamps.
How do data subjects submit requests?
The platform includes a configurable Salesforce Experience Cloud portal form where data subjects provide name, email, and request type (access, correction, deletion, restriction). Organizations without Experience Cloud can accept requests via email intake entered manually by the privacy team, with identical processing regardless of method.
How does Privacy Rights Automation verify the identity of the requester?
The verification workflow is configurable using email verification links, Knowledge-Based Authentication (KBA) questions, or manual privacy team review for high-risk requests. The verification step and its outcome are logged for audit purposes.
What happens after identity is verified?
The system automatically queries configured Salesforce objects for matching records by email, phone, and/or ID fields. Matches are presented to the privacy team for review before cascade deletion or data export generation, with all actions timestamped in the request audit log.
How long does a DSAR take to process with Privacy Rights Automation?
For standard deletion requests, automated processing takes 15-30 minutes for the system work (discovery + deletion). Total elapsed time including verification and human review typically falls under 2 business days, well within GDPR's 30-day and CCPA's 45-day deadlines.
What is the difference between deletion and anonymization for DSAR fulfillment?
Deletion removes the record entirely. Anonymization replaces personal data fields with non-identifying values while preserving the record shell for analytics and compliance history. Both fulfill GDPR Article 17 requirements if the individual becomes unidentifiable; the choice depends on record type and business needs.
Can Privacy Rights Automation handle access requests (not just deletion)?
Yes, the system discovers all records matching the requester's identity and generates structured data exports. Export formats are configurable: PDF report, CSV, or structured JSON.
What volume of DSARs can Privacy Rights Automation handle?
Privacy Rights Automation handles concurrent requests without volume limits. Each request runs as an independent Salesforce process. The system supports enterprise-scale volumes; the bottleneck is human review capacity rather than processing speed.
How does Privacy Rights Automation handle GDPR Article 17 right to erasure?
Upon verified erasure requests, the system executes cascade deletion across configured Salesforce objects containing personal data including Contacts, related Cases, Activities, EmailMessages, field history, and custom objects. The deletion sequence is configurable to respect object dependencies.
What Salesforce objects are included in GDPR erasure by default?
Default scope encompasses Contact, Lead, related Cases, Activities (Tasks, Events), EmailMessages, ContentDocumentLink (attached files), and field history for masked objects. Custom objects with lookup relationships to Contact can be added; the scope is fully configurable.
How does Privacy Rights Automation handle erasure for data in field history?
Salesforce field history is a separate data store from the record itself. Privacy Rights Automation includes field history in the erasure scope: history entries for the subject's fields are deleted as part of the erasure sequence.
What happens when an erasure request involves a subject with active contracts?
The system evaluates exception conditions before deletion. Active contracts, open cases, and pending financial transactions can trigger partial anonymization instead of full deletion, preserving business records while removing personal identifiers. Exceptions are logged with reasons for GDPR documentation.
How do we handle erasure for data that's also in Marketing Cloud?
Privacy Rights Automation integrates with Marketing Cloud for DSAR scope expansion. When Salesforce erasure is processed, a suppression record is created in Marketing Cloud to prevent future sends, with API calls to MC's transactional messaging suppression list triggered for data deletion.
Does erasure in Salesforce also erase data in sandbox environments?
Yes, if configured—the system can trigger sandbox cleanup via DataMasker's API. However, the preferred approach is preventive masking on every refresh, ensuring sandboxes never contain real subject data, eliminating need for sandbox-specific erasure handling.
How do we document GDPR erasure for DPA audit purposes?
Privacy Rights Automation creates a Request record in Salesforce with: requester identity (hashed for privacy), request date, verification method and date, objects processed, deletion count, exception records (and reason), and completion timestamp.
What happens if an erasure fails for some records?
Privacy Rights Automation logs all failures with the specific record ID and error reason. Common failures include locked records, validation rules preventing deletion, or exception-excluded records. The privacy team is notified of partial completions for manual resolution or documentation.
How does Privacy Rights Automation handle CCPA deletion requests?
The system applies jurisdiction-specific rules including 45-day deadline tracking, CCPA-specific exception categories (legal obligation, contract completion), and California AG-compliant documentation. GDPR and CCPA requests flow through identical infrastructure with jurisdiction-aware enforcement.
Can one system handle GDPR and CCPA requests simultaneously?
Yes, this is the standard deployment pattern. Privacy Rights Automation uses request-level jurisdiction tagging. A request from an EU resident is processed under GDPR rules; a California resident's request under CCPA. Deadlines, exceptions, and documentation vary by jurisdiction.
How does Privacy Rights Automation handle patient data deletion under HIPAA/HITECH?
The system handles Health Cloud deletion requests with HIPAA-compliant processing including PHI discovery across Health Cloud objects, cascade deletion with referential integrity preservation, and OCR-ready audit documentation. Exception handling for records with HIPAA minimum retention requirements (6 years) is configurable.
Does Privacy Rights Automation handle India DPDP Act erasure and access requests?
Yes, the system handles India's DPDP Act (2023) by configuring Indian jurisdiction rules to identify Indian resident records, apply DPDP Act deletion logic, and generate compliant documentation. The same automation layer simultaneously handles GDPR, CCPA, and DPDP requests.
How do we handle deletion requests for data shared with third parties?
The system processes deletion within your Salesforce organization. For data shared with third parties, it can trigger API calls to those systems if deletion APIs are exposed. For manual notification, the request audit log includes a checklist of third parties with acknowledgment tracking.
Can Privacy Rights Automation handle correction requests (not just deletion)?
Yes, GDPR Article 16 enables correction rights. Privacy Rights Automation includes a correction workflow: the subject submits the corrected data via the intake form, the privacy team reviews and approves, and the correction is applied to all identified records.
What is the 'right to restriction' and how does Privacy Rights Automation handle it?
GDPR Article 18 gives individuals the right to restrict processing: their data is retained but not actively processed. The system implements this by setting a 'Processing Restricted' flag on subject records, with configured business processes checking this flag to suppress marketing, profiling, and data sharing.
How do we handle DSARs when we can't identify the subject with certainty?
The system escalates to manual privacy team review with a configurable hold period when identity cannot be confirmed with high confidence. GDPR guidance allows organizations to decline requests where identity cannot be reasonably verified: this decision is logged.
How do we report DSAR metrics to our DPO and legal team?
Privacy Rights Automation includes a reporting dashboard: requests by type (deletion/access/correction), by jurisdiction, by month, average fulfillment time, exception rate, and pending requests. Reports satisfy GDPR Article 30 record-keeping requirements and provide legal visibility into compliance posture.