Answer a data access request

The report is what a person may ask for under the GDPR's right of access (art. 15), and what your data protection officer needs to answer it. It lists events about one person by your id for them, so you look up the id in your own app first.

What a report holds

• What it covers: the person's id, with a link to them in your console when the project's Links are set; how many events are about them, and how many things they did themselves; the time it covers, from the oldest event kept; whether the log was whole at its last check; and when the report was made, by whom.
• Who handled their data: each person, operator or job once, most first, with what they did, how often, and the first and last time.
• Every event about them: newest first, with times on your own clock, 50 to a page.

Open a person's report

In the project in Audit, open People, type your id for the person and choose Open report. A search for one person on Events links to Their access report too.

The report is for people with Triage or Admin in Audit.

Print or export it

• Print prints the report, without the links that lead into Audit. Print it to PDF to send it.
• Export CSV downloads every event about the person, not only the page you see, with the same columns as an events export.

Make the reports complete

An event is about a person when they are its subject, or its target as Target::person(). Events that name them only in the context, or under another target kind, are not in their report. So give each event about a person one of the two:

// They are the subject: the data is about them.
Audit::record('invoice.downloaded', Actor::operator($operator->id),
    Target::of('invoice', $invoice->id), subject: $invoice->user_id);

// They are the target: something was done to them.
Audit::record('person.blocked', Actor::operator($operator->id),
    Target::person($user->id), reason: $reason);

What they did themselves, as Actor::person(), is counted in the report and opens as a search of its own.

The report covers what is kept. Events older than the months the project keeps are gone, and the report says from when it starts. Months events are kept says how to change it.

Opening one is recorded

Opening a report, and each export of one, is written in Audit's own log with the person's id. The project's admins see it on Who read it, and the report itself says so.