Managing consent and privacy
Two related obligations: knowing what you are permitted to do with a person's data, and responding when they exercise their rights.
Consent records
The compliance section, where consent records and data subject requests are managed.
A consent record captures a specific permission: which entity, for what purpose, on what legal basis, and for how long.
Legal basis is the load-bearing field. Consent is only one of several lawful bases, and they behave differently:
| Legal basis | Withdrawable |
|---|---|
| Consent | Yes — the subject may withdraw at any time |
| Contract | No — processing is necessary to perform a contract |
| Legal obligation | No — you are required to process |
| Legitimate interests | No — subject to a balancing test |
Attempting to withdraw a record held under a non-consent basis is refused. This is not a limitation — it is the point. Withdrawing "we retain this because the law requires it" would misrepresent your actual legal position.
Withdrawal
Withdrawing a consent record revokes it while preserving the record itself. What was permitted, and when it stopped being permitted, both stay answerable.
Data subject requests
A privacy request is tracked from receipt through to fulfilment, with its type, its subject, and its outcome recorded.
| Type | Asks for |
|---|---|
| Access | A copy of what you hold |
| Rectification | Inaccurate data corrected |
| Erasure | Data deleted |
| Portability | Data in a portable form |
Erasure is selective, not total
Fulfilling an erasure request revokes every consent-based permission on the subject and retains those held under a basis that does not permit erasure.
The response records exactly what was revoked and what was retained, with the reason. That record is what you show a regulator: erasure was honoured to the extent the law requires, and the retained items are individually justified.
Erasing data you are legally required to keep would itself be a violation.
Consent and access control
Consent can gate access directly: a ABAC policy can allow access to a record only while a consent of a given type is active. Withdrawing consent then changes what callers can see, without anyone editing a permission.
This is what turns consent from a record you keep into a control that operates.
Merging and consent
When entities merge, consent records follow onto the survivor. A person's consents are not fragmented by the discovery that two records were the same person all along.
Next
Last verified against commit 315eb047 (2026-08-03)