Data protection: workflows

Use the data protection dashboard

Click on Data protection on the front page to go to the data protection dashboard. This dashboard lists tasks you need to take care of by initiating follow-up steps for each category.

• A subject is tagged Export requested if they requested a GDPR export. See Export all data related to a subject for the necessary steps.

• A subject is tagged To be deleted, No legal basis, or Unreachable if they should be deleted for different reasons. See Delete a subject for the necessary steps.

• A subject is tagged Unnecessary recruitment data if they have recruitment data, but no recruitment consent. See Clear unnecessary recruitment data for the necessary steps.

In all those categories it usually makes sense to contact the subjects before taking any action. For example, subjects often want only a part of their data deleted.

Most of the categories have legal time limits, so you should check the dashboard regularly.

Hint

It is recommended to configure an email address that should receive email notifications about new data protection tasks. Please ask your system administrator to setup CASTELLUM_GDPR_NOTIFICATION_TO.

Export all data related to a subject

According to GDPR, subjects have the right to get an export of all their data. This is especially important for scientific measurements that need to be provided in a common file format. Compared to that, the data stored in castellum is rather simple (e.g. name and address). Still, it is possible to generate a complete list of all the information that is stored in castellum on a single subject.

1. In the subject details, go to the Export tab

2. If you see a message saying No export requested, you need to explicitly Request export. The date of the request will be stored.

3. The complete list can be printed or otherwise stored.

4. Once the subject has received the export, click Mark as answered to record how long it took to process this request.

Warning

These steps only outline the data export from a software view. Your institute should provide organizational steps to verify actual identity of the requester. Furthermore, secure transfer of exported data needs to be set up.