GDPR Subject Requests: Data Access & Erasure

GDPR Subject Requests: Data Access & Erasure. A register for GDPR access, erasure and portability requests: statutory deadline chased, identity verified, and a response package that opens. Odoo's privacy lookup finds records. It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see.

One month from receipt under Art. 12(3) — not from the day somebody notices the email. The deadline is computed and shown as days remaining, and a request past it is flagged in red. In the next few minutes: what this is for, then the clock, then identity first, then finding the data, then the response.

Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Data Protection then Subject Requests. 1. Copy bambooforge_gdpr into your addons path and update the app list, or install the ZIP from the Odoo Apps Store.

2. Install GDPR Subject Requests: Data Access & Erasure. 3. Open Data Protection - its menus are Subject Requests.

What this is for. Odoo's privacy lookup finds records. It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see. The clock.

One month from receipt under Art. 12(3) — not from the day somebody notices the email. The deadline is computed and shown as days remaining, and a request past it is flagged in red. An extension adds two further months and needs a written reason, because the person has to be told why within the first month.

A second extension is refused: the article allows two extra months, not four. Identity first. A request cannot be answered until identity is confirmed and how it was checked is written down. Handing somebody else's data to an impostor is itself a breach, and "we assumed it was them" is not a defence.

Finding the data. Find Their Data searches every model in this database that carries an email field, skipping transient models, the mail queue and log tables — they either disappear on their own or hold copies of what is found elsewhere. The search is case-insensitive; a blank email finds nothing rather than everything. Each hit becomes a line that must be given a decision: exported, anonymised, erased, or kept.

The request will not be marked answered while any line is still undecided. The response. Build Response Package produces a zip: an index of every record found and what happened to it, one readable JSON per exported record, and a cover note. Art.

15 says provide a copy; a letter saying "we hold some data about you" is not one. Binary fields are left out on purpose. A data export is meant to be read by the person who asked, and base64 blobs are neither readable nor what they asked for. Refusing.

A refusal needs the exemption stated. A refusal with no ground is the single thing supervisory authorities pick up every time. How we make sure it works. Before every release, 28 automated checks run against this app on Odoo 16, 17, 18, 19 and 20.

Among them: Identity cannot be confirmed without saying how. A package cannot be built before scanning. Scanning twice does not duplicate. A request with no email finds nothing rather than everything.

A plain employee does not see the menu. The complete list is in the source you receive. Questions people ask. Which Odoo versions does it run on?

Odoo 16.0, 17.0, 18.0, 19.0, 20.0, on the series you buy it for; each series is its own listing. Community or Enterprise? Both. It needs no Enterprise app.

Now the part most videos leave out: what this does not do. The scan covers models with an email field. Data tied to a person only through a link — a delivery address on an order, a name in a note — is not found automatically. Erasure and anonymisation are recorded here; performing them is done on the records themselves, with Odoo's privacy lookup or by hand.

One controller per company. Joint controllership arrangements are not modelled. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.

GDPR Subject Requests: Data Access & Erasure. A register for GDPR access, erasure and portability requests: statutory deadline chased, identity verified, and a response package that opens. Odoo's privacy lookup finds records. It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see.

One month from receipt under Art. 12(3) — not from the day somebody notices the email. The deadline is computed and shown as days remaining, and a request past it is flagged in red. In the next few minutes: what this is for, then the clock, then identity first, then finding the data, then the response.

Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Data Protection then Subject Requests. What this is for. Odoo's privacy lookup finds records.

It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see. The clock. One month from receipt under Art. 12(3) — not from the day somebody notices the email.

The deadline is computed and shown as days remaining, and a request past it is flagged in red. An extension adds two further months and needs a written reason, because the person has to be told why within the first month. A second extension is refused: the article allows two extra months, not four. Identity first.

A request cannot be answered until identity is confirmed and how it was checked is written down. Handing somebody else's data to an impostor is itself a breach, and "we assumed it was them" is not a defence. Finding the data. Find Their Data searches every model in this database that carries an email field, skipping transient models, the mail queue and log tables — they either disappear on their own or hold copies of what is found elsewhere.

The search is case-insensitive; a blank email finds nothing rather than everything. Each hit becomes a line that must be given a decision: exported, anonymised, erased, or kept. The request will not be marked answered while any line is still undecided. The response.

Build Response Package produces a zip: an index of every record found and what happened to it, one readable JSON per exported record, and a cover note. Art. 15 says provide a copy; a letter saying "we hold some data about you" is not one. Binary fields are left out on purpose.

A data export is meant to be read by the person who asked, and base64 blobs are neither readable nor what they asked for. Refusing. A refusal needs the exemption stated. A refusal with no ground is the single thing supervisory authorities pick up every time.

Now the part most videos leave out: what this does not do. The scan covers models with an email field. Data tied to a person only through a link — a delivery address on an order, a name in a note — is not found automatically. Erasure and anonymisation are recorded here; performing them is done on the records themselves, with Odoo's privacy lookup or by hand.

One controller per company. Joint controllership arrangements are not modelled. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.

GDPR Subject Requests: Data Access & Erasure. A register for GDPR access, erasure and portability requests: statutory deadline chased, identity verified, and a response package that opens. Odoo's privacy lookup finds records. It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see.

One month from receipt under Art. 12(3) — not from the day somebody notices the email. The deadline is computed and shown as days remaining, and a request past it is flagged in red. In the next few minutes: what this is for, then the clock, then identity first, then finding the data, then the response.

Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Data Protection then Subject Requests. What this is for. Odoo's privacy lookup finds records.

It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see. The clock. One month from receipt under Art. 12(3) — not from the day somebody notices the email.

The deadline is computed and shown as days remaining, and a request past it is flagged in red. An extension adds two further months and needs a written reason, because the person has to be told why within the first month. A second extension is refused: the article allows two extra months, not four. Identity first.

A request cannot be answered until identity is confirmed and how it was checked is written down. Handing somebody else's data to an impostor is itself a breach, and "we assumed it was them" is not a defence. Finding the data. Find Their Data searches every model in this database that carries an email field, skipping transient models, the mail queue and log tables — they either disappear on their own or hold copies of what is found elsewhere.

The search is case-insensitive; a blank email finds nothing rather than everything. Each hit becomes a line that must be given a decision: exported, anonymised, erased, or kept. The request will not be marked answered while any line is still undecided. The response.

Build Response Package produces a zip: an index of every record found and what happened to it, one readable JSON per exported record, and a cover note. Art. 15 says provide a copy; a letter saying "we hold some data about you" is not one. Binary fields are left out on purpose.

A data export is meant to be read by the person who asked, and base64 blobs are neither readable nor what they asked for. Refusing. A refusal needs the exemption stated. A refusal with no ground is the single thing supervisory authorities pick up every time.

Now the part most videos leave out: what this does not do. The scan covers models with an email field. Data tied to a person only through a link — a delivery address on an order, a name in a note — is not found automatically. Erasure and anonymisation are recorded here; performing them is done on the records themselves, with Odoo's privacy lookup or by hand.

One controller per company. Joint controllership arrangements are not modelled. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.

GDPR Subject Requests: Data Access & Erasure. A register for GDPR access, erasure and portability requests: statutory deadline chased, identity verified, and a response package that opens. Odoo's privacy lookup finds records. It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see.

One month from receipt under Art. 12(3) — not from the day somebody notices the email. The deadline is computed and shown as days remaining, and a request past it is flagged in red. In the next few minutes: what this is for, then the clock, then identity first, then finding the data, then the response.

Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Data Protection then Subject Requests. What this is for. Odoo's privacy lookup finds records.

It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see. The clock. One month from receipt under Art. 12(3) — not from the day somebody notices the email.

The deadline is computed and shown as days remaining, and a request past it is flagged in red. An extension adds two further months and needs a written reason, because the person has to be told why within the first month. A second extension is refused: the article allows two extra months, not four. Identity first.

A request cannot be answered until identity is confirmed and how it was checked is written down. Handing somebody else's data to an impostor is itself a breach, and "we assumed it was them" is not a defence. Finding the data. Find Their Data searches every model in this database that carries an email field, skipping transient models, the mail queue and log tables — they either disappear on their own or hold copies of what is found elsewhere.

The search is case-insensitive; a blank email finds nothing rather than everything. Each hit becomes a line that must be given a decision: exported, anonymised, erased, or kept. The request will not be marked answered while any line is still undecided. The response.

Build Response Package produces a zip: an index of every record found and what happened to it, one readable JSON per exported record, and a cover note. Art. 15 says provide a copy; a letter saying "we hold some data about you" is not one. Binary fields are left out on purpose.

A data export is meant to be read by the person who asked, and base64 blobs are neither readable nor what they asked for. Refusing. A refusal needs the exemption stated. A refusal with no ground is the single thing supervisory authorities pick up every time.

Now the part most videos leave out: what this does not do. The scan covers models with an email field. Data tied to a person only through a link — a delivery address on an order, a name in a note — is not found automatically. Erasure and anonymisation are recorded here; performing them is done on the records themselves, with Odoo's privacy lookup or by hand.

One controller per company. Joint controllership arrangements are not modelled. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.

GDPR Subject Requests: Data Access & Erasure. A register for GDPR access, erasure and portability requests: statutory deadline chased, identity verified, and a response package that opens. Odoo's privacy lookup finds records. It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see.

One month from receipt under Art. 12(3) — not from the day somebody notices the email. The deadline is computed and shown as days remaining, and a request past it is flagged in red. In the next few minutes: what this is for, then the clock, then identity first, then finding the data, then the response.

Then what this app deliberately does not do, so you can tell before you buy whether it fits. Everything lives under Data Protection then Subject Requests. What this is for. Odoo's privacy lookup finds records.

It does not record that somebody asked, what they asked for, when the answer is legally due, whether their identity was checked, or what was actually done — which is the whole content of the file a supervisory authority asks to see. The clock. One month from receipt under Art. 12(3) — not from the day somebody notices the email.

The deadline is computed and shown as days remaining, and a request past it is flagged in red. An extension adds two further months and needs a written reason, because the person has to be told why within the first month. A second extension is refused: the article allows two extra months, not four. Identity first.

A request cannot be answered until identity is confirmed and how it was checked is written down. Handing somebody else's data to an impostor is itself a breach, and "we assumed it was them" is not a defence. Finding the data. Find Their Data searches every model in this database that carries an email field, skipping transient models, the mail queue and log tables — they either disappear on their own or hold copies of what is found elsewhere.

The search is case-insensitive; a blank email finds nothing rather than everything. Each hit becomes a line that must be given a decision: exported, anonymised, erased, or kept. The request will not be marked answered while any line is still undecided. The response.

Build Response Package produces a zip: an index of every record found and what happened to it, one readable JSON per exported record, and a cover note. Art. 15 says provide a copy; a letter saying "we hold some data about you" is not one. Binary fields are left out on purpose.

A data export is meant to be read by the person who asked, and base64 blobs are neither readable nor what they asked for. Refusing. A refusal needs the exemption stated. A refusal with no ground is the single thing supervisory authorities pick up every time.

Now the part most videos leave out: what this does not do. The scan covers models with an email field. Data tied to a person only through a link — a delivery address on an order, a name in a note — is not found automatically. Erasure and anonymisation are recorded here; performing them is done on the records themselves, with Odoo's privacy lookup or by hand.

One controller per company. Joint controllership arrangements are not modelled. The complete manual is at docs dot bambooforge dot dev, the demo database is linked from the store page, and support answers within twenty-four hours. Links are in the description.