Data & Privacy

Compliance → Data & Privacy is where you answer people who ask what you hold about them or want it deleted.

Linking sessions to a person

Your application says who a session is about by setting subjectReference in the SDK’s session context. Use a stable internal ID, such as a customer number, rather than a name or email.

When you add that person as a data subject, enter the same value. VeriProof then finds all of their sessions, including ones recorded before you added them. Sessions without a subject reference can’t be linked to anyone.

Handling requests

For an access request, export the person’s data as JSON, or build an evidence pack when someone needs to check the records independently. Exports leave out names and identifiers unless your role can see personal data.

A legal hold keeps a person’s data from being deleted until a date you choose. Placing holds depends on your plan , but a hold can always be removed.

An erasure request removes the person’s sessions after a 30-day wait. See GDPR erasure for what’s removed and what stays.

Retention, lineage and DPIA

Data retention shows which sessions are close to their deletion date. Data lineage shows each application’s data by sensitivity level. DPIA drafts a starting point for a Data Protection Impact Assessment from recent session metadata, without reading session content.

Who can use it

By default, administrators and compliance officers can both add data subjects, export their data, manage holds, and request or cancel erasure. Only administrators see the identifiers themselves; compliance officers work from the DS- reference. Your administrator can change this under Role permissions.