Consent and privacy at a glance
Legal basis decides everything
| Basis | Withdrawable | Erasable on request |
|---|---|---|
| Consent | Yes | Yes |
| Contract | No | No |
| Legal obligation | No | No |
| Legitimate interests | No | No |
Only a consent-based record can be withdrawn. Refusing the others is not a limitation — it is a refusal to misrepresent your legal position.
The test is exact: a record is withdrawn if its basis is consent, and retained otherwise. The platform does not weigh legitimate interests against the subject's rights — that balancing is your judgement to make and record, not something the software performs for you.
Legal basis is stored as free text; only the exact value consent is treated
as withdrawable. Agree the vocabulary across integrations.
Erasure retains, and that is correct
| Action | Applies to |
|---|---|
| Revoke | Every active consent-based record on the subject |
| Retain | Records under a basis that does not permit erasure |
| Record | What was revoked, what was retained, and why |
That record is what you show a regulator. Erasing data you are legally required to keep would itself be a violation.
The mistake that matters
If the person still exists as several unmerged records, acting on one leaves the others untouched — and you will have told a regulator you erased data you did not.
Search first. The whole purpose of mastering is that a privacy request has one target.
Request types
Access · rectification · erasure · portability.
Consent as a live control
A ABAC policy can allow access only while a consent of a given type is active. Withdrawing consent then changes what callers see, without anyone editing a permission — which is what turns consent from a record you keep into a control that operates.
Merging
Consent records follow onto the survivor. A person's consents are not fragmented by the discovery that two records were the same person.
Next
Last verified against commit 1e1de1ad (2026-08-03)