Consent and privacy reference
Legal bases
Consent records. Legal basis is the field that decides whether a record can be withdrawn.
| Basis | Withdrawable | Erasable on request |
|---|---|---|
| Consent | Yes | Yes |
| Contract | No | No |
| Legal obligation | No | No |
| Legitimate interests | No | Subject to a balancing test |
Only a consent-based record can be withdrawn. Attempting to withdraw another is refused — not a limitation, but a refusal to misrepresent your legal position.
The platform stores whatever string you supply and only treats the exact value
consent as withdrawable. The bases above are the conventional set, not an
enumeration the platform enforces — so agree the vocabulary across your
integrations, because a typo produces a record that can never be withdrawn.
Consent record states
| State | Meaning |
|---|---|
| Granted | In force |
| Revoked | Withdrawn or erased; the record is retained |
| Expired | Past its validity period |
Revocation preserves the record. What was permitted, and when it stopped being permitted, both stay answerable.
Privacy request types
| Type | Asks for |
|---|---|
| Access | A copy of what is held |
| Rectification | Inaccurate data corrected |
| Erasure | Data deleted |
| Portability | Data in a portable form |
What erasure does
| Action | Applies to |
|---|---|
| Revoke | Every active consent-based record on the subject |
| Retain | Records under a basis that does not permit erasure |
| Record | What was revoked, what was retained, and why |
Consent as an access control
A ABAC policy can allow access to a record only while a consent of a given type is active. Withdrawing consent then changes what callers can see, without anyone editing a permission.
This is what turns consent from a record you keep into a control that operates.
Merge behaviour
Consent records follow onto the survivor when entities merge. A person's consents are not fragmented by the discovery that two records were the same person.
Next
Last verified against commit 74cecd91 (2026-08-03)