PPactDocs
Administration

Privacy controls

Pact's GDPR privacy surfaces — self-service data export and 30-day deletion for users, plus admin-triggered exports and the grace-period deletion sweep.

Privacy controls

Pact ships self-service GDPR privacy tooling for end users and an admin surface for handling requests on their behalf. The routes are in api/routes/privacy.py; the underlying primitives (export packaging, deletion scheduling, grace periods) live in core/gdpr.

Self-service (any authenticated user)

Any valid tenant user can manage their own data — no special permission required beyond being signed in:

code
GET    /v1/me/privacy                          — current privacy state
POST   /v1/me/privacy/export                   — request a data export (202)
GET    /v1/me/privacy/export/download/{token}  — download the ZIP (token-only)
POST   /v1/me/privacy/delete                   — schedule 30-day deletion (202)
DELETE /v1/me/privacy/delete                   — cancel a scheduled deletion

Deletion is a 30-day scheduled operation, not an instant hard-delete, so an accidental request can be cancelled during the grace period. The export download link is token-scoped and does not require an active login.

Admin surface

Admins with the right permission handle requests across the tenant:

  • List requests — GET /v1/admin/privacy/requests (requires CONSENT_ERASE) returns pending exports and scheduled deletions.
  • Export on behalf of a user — POST /v1/admin/users/{user_id}/data-export (requires CONSENT_EXPORT) triggers a GDPR Article 20 portability export.
  • Run the deletion sweep — POST /v1/admin/privacy/cron (requires CONSENT_ERASE) processes deletions whose grace period has elapsed.

Article 20 stays in the data subject's hands

When an admin triggers an export for a user, the download link is always emailed to the target user's verified address — the admin cannot redirect delivery. The admin's identity is captured in the audit event so security teams can see who triggered the export and when. If the target user has no email on file, the request returns 409 rather than delivering to the admin.

Where erasure permission comes from

CONSENT_ERASE and CONSENT_EXPORT are typed permissions in core/permissions.py. The compliance (DPO) role is read-only by default and includes consent:read and audit_log:read; to let a DPO also execute erasure, a tenant grants consent:write (or a dedicated erase key) via the per-tenant role override UI — it is off by default.

Related but separate surfaces

Data-subject access requests (DSAR) have their own workflow under /v1/dsar, and cookie/consent management is handled elsewhere in the platform. This page covers the user-account privacy surface (/v1/me/privacy and /v1/admin/privacy) specifically.

Roles & permissionsGrant consent:write to a DPO.Audit logEvery export and deletion is recorded.Security settingsTenant-wide security posture.User detailTrigger a per-user export.