Plan requirement
| Subscription | Any plan |
| Access | Admin |
Somebody asks what you hold about them, or asks you to delete it. What Zendesk can do, and what you decide.
The steps
- Verify who is asking. This comes first, always.
- Find everything: their user record, their tickets, tickets where they are CC'd, and any attachments.
- Decide what the request covers and what you are obliged to keep.
- Export, redact or delete accordingly.
- Record what you did and when.
Verify first
A request arriving by email is a request from an email address. Acting on it without verification is how you hand somebody's data to whoever asked for it.
This is the step that gets skipped under time pressure, and it is the one that turns a routine request into an incident.
Searching is the hard part
People appear under several email addresses, in tickets they did not raise, inside attachments and in the text of other people's tickets. A search on their address finds the obvious cases and not all of them.
Deletion is not always the answer
You may be obliged to keep records for tax, contractual or legal reasons. Deleting everything on request can breach a different obligation, so the scope needs deciding rather than assuming.
Where obligations conflict, that is a question for whoever owns compliance in your organisation.
Redaction is often the right tool
It removes the personal data and keeps the ticket, so your history and reporting survive. For most requests that is a better outcome than deleting the record entirely.
Write down what you did
What was asked, when, how identity was verified, what was removed, and what was kept and why. If anybody asks later, that record is the answer.
Comments
0 comments
Article is closed for comments.