Data subject requests

A person can ask to see, to correct, to erase or to get a copy of the personal data that a deployment or a hosting provider holds about them. This page tells, for each store that holds personal data, which party answers such a request, and which mechanism the code in this repository gives for it. Where the code gives no mechanism, the page says "no mechanism found".

This page is not legal advice. It does not tell if a request is valid, which data is in its scope, or how much time the answer can take. It tells only what the code can do.

The stores and their personal data are in Data protection. The part state-register has the full list of the state that the system stores. This page does not repeat these lists.

Who answers a request

The party that controls the data answers the request. Data protection gives the roles:

• The operator is the controller of the data of its deployment: the accounts and the content of its applications, and the users of the lldap and of the Authelia of its group.
• The hosting provider is the controller of its own data: the accounts of the panel, the users of the lldap of the hosting-provider group, the audit records, and the accounts of Grafana, NetBox and Windmill.
• The hosting provider is the processor of the operator for the data of a deployment. For some stores of a deployment, only the hosting provider has a tool, for example a command on a node or a backup. Then the operator answers the request, and the hosting provider does the step.

flowchart TD
  request["Request of a person"] --> which{"Which data?"}
  which -->|"Data of a deployment"| operator["Operator answers"]
  which -->|"Data of the hosting provider"| provider["Hosting provider answers"]
  operator --> app["Functions of the application"]
  operator --> lldap["lldap of the group"]
  operator --> config["Configuration in the panel, for example deleteData"]
  operator -->|"asks for a step on a node, a log or a backup"| provider
  provider --> panel["Panel account page and admin pages"]
  provider --> api["Routes of api/"]
  provider --> node["Commands on a node, logs, backups"]

Mechanisms that the code gives

The panel and api/ have no route that finds, changes, erases or exports the data of one user of an application. The functions of the application do this work. This repository does not contain the code of the applications, thus this page does not describe these functions. Find them in the documentation of the application version that the deployment runs.

Data of a deployment

The operator answers a request about this data.

After a restore from a backup that is older than an erasure, the erasure must be done again. The operation "Record an erasure" of an application keeps the time and the reference of each erasure on the node, and a restore from an older snapshot lists them until "Confirm the erasures". See Do the erasures again after a restore.

The export of a deployment for a migration gives all the data of the deployment to a different hosting provider, and stops its applications. It is not an export for one person. See Export a deployment for a migration.

Data of the hosting provider

The hosting provider answers a request about this data. The persons are the staff of the operators and the staff of the hosting provider.

The removal of a panel account first erases the domain contact of the account. A contact that a domain of the registrar account names stays, and the panel writes a warning to its log. The removal does not remove the audit events of its actor or the user in lldap. Each of these is a different store with its own row in this table.

Where no mechanism exists

The code gives no mechanism for these requests:

• An export of the data of one person, for all stores but the accounts of the applications. The export of a deployment is for the deployment as a whole (#3058).
• Access, rectification or erasure for one person in the logs, the telemetry, the jobs of Windmill and the audit records. Only the retention removes this data. The account history of the panel gives access to the audit events of one actor (#3062).
• Access, rectification or erasure in the database of Authelia and in the caches of the applications (#3061).
• Erasure of one record from a restic backup before it expires. The procedure removes whole snapshots (#3060).
• A page where a panel account removes itself, or changes its user name or email address (#3056).
• One command or one page that finds all the data of one person in all stores. A party that answers a request goes to each store (#3057).

#2194 tracks the compliance needs of customers in the EU, and these gaps belong to it.