Register GDPR Request API: registerGdprRequest

The Register GDPR Request API plays a crucial role in GDPR compliance by enabling users to submit requests for accessing or forgetting their personal data. This functionality aligns with GDPR's "Right to Access" and "Right to Forget" principles. When a request is made, the API securely processes personal identifiers and registers the request to either retrieve (access) or erase (forget) the user's data. Its flexibility to handle different types of requests, like access or deletion, makes it an essential tool for maintaining GDPR compliance in data handling practices.

By default, Real-time CDP processes all the captured requests daily at midnight, according to your time zone. If you wish to modify the processing frequency, please contact your Customer Success Manager (CSM) or the Algonomy support team for assistance.

'Right to Access' Request

Retrieves all personal data for a specific customer using their identifier and provide it as a single downloadable ZIP file in AWS S3. The ZIP file will contain multiple CSV files. After the request is submitted, it may take up to 24–48 hours to process and prepare the file.

API Endpoint and Method

URL Format

https://{GDPR_API_URL}/api/v1/gdpr/b2b/registerGdprRequest
			

Example URL

https://api-dev.algonomy.com/rcdpapi/api/v1/gdpr/b2b/registerGdprRequest
			

HTTP Method

POST

To get the {GDPR_API_URL} contact your CSM or Algonomy support team.

Request Header

Include the following parameters in your request header:

In Request Body, for a given reqParam type, the corresponding reqParamValue should be given into the header. reqParamValue can be sensitive data hence it is a part of request header.

Request Body

{
"reqType":"access", 
"reqParam":"{REQ_PARAM_IDENTIFER}", 
"reqSource":"{REQUEST_SOURCE}" 

}
			

In the request payload, the following parameters are used to specify key details for the GDPR request:

• reqType: Specifies the type of GDPR request. This field is critical for indicating the nature of the original request, such as "access" for data access requests or "forget" for data deletion requests.

• reqParam: Defines the customer identification type such as email, mobile number, gcrid. It is necessary to include at least one such customer identifier in each API request.

• reqSource: Describes the source of the request, which can support up to a 10-character string and can be any valid string.

Available customer identifiers are:

Response Body

Successful request:

Returned when the request is submitted successfully.

HTTP status: 200 OK

{
"status": "OK",
"data":
{
"message": "Request submitted successfully.",
"trackingId": 595
}
}
			

Ensure that you are provided “trackingId” in the response to track the status of the created GDPR forget/access request using the gdprRequestStatus API.

Duplicate access request:

Returned when an access request already exists and is pending execution.

HTTP status: 500 Internal Server Error

{
"error": "Request already exist with tracking id:[399] and request status : [registered]"
}
			

Existing delete request pending:

Returned when a delete (forget) request already exists for the same customer and is pending execution.

HTTP status: 500 Internal Server Error

{
"error": "Request already exist for [forget] with tracking id:399, revoke the existing request before raising any new request."
}
			

Internal server error:

Returned when an error occurs during request submission.

HTTP status: 500 Internal Server Error

{
 "error": "Internal server error while registering the request."
}
			

Variables

‘Right to Forget’ Request

Important: The ‘Right to Forget’ request will completely erase the customer identification information from the system, and it cannot be rolled back once it has been executed successfully.

API Endpoint and Method

URL Format

https://{GDPR_API_URL}/api/v1/gdpr/b2b/registerGdprRequest
			

Example URL

https://api-dev.algonomy.com/rcdpapi/api/v1/gdpr/b2b/registerGdprRequest
			

HTTP Method

POST

To get the {GDPR_API_URL} contact your CSM or Algonomy support team.

Request Header

Include the following parameters in your request header:

In Request Body, for a given reqParam type, the corresponding reqParamValue should be given into the header. reqParamValue can be sensitive data hence it is part of the request header.

Request Body

{
"reqType":"forget",
"reqParam":"gcrid",
"reqSource":"test_1"
}
			

In the request payload, the following parameters are used to specify key details for the GDPR request:

• reqType: Specifies the type of GDPR request. This field is critical for indicating the nature of the original request, such as "access" for data access requests or "forget" for data deletion requests.

• reqParam: Defines the customer identification type such as email, mobile number, gcrid. It is necessary to include at least one such customer identifier in each API request.

• reqSource: Describes the source of the request, which can support up to a 10-character string and can be any valid string.

Available customer identifiers are:

Response Body

A successful request returns “200 – OK” along with the following retrieved data as response.

{
"status": "OK",
"data":
{
"message": "Request submitted successfully.",
"trackingId": 595
}
}
			

Ensure that you receive a trackingId in the response. This identifier is essential for tracking the status of the created GDPR forget/access request using the gdprRequestStatus API.