Will GDPR Delete API delete full interaction data?

[Sai_tt]

I tried using GDPR_DELETE and request status was changed to Completed. In genesys, I see recording data is deleted but the interaction record still exists. Is it possible to delete full data of interaction along with the recording data?

[tim.smith]

No, GDPR requests redact PII. You cannot erase history.

[Sai_tt]

Thanks for the reply @tim.smith . After deleting the data using GDPR_DELETE, we are still seeing the Phone number on the interaction. Is it possible to delete the Phone number from the interaction data using the GDPR_DELETE API?

[tim.smith]

If a GDPR delete request has completed but did not remove the expected data and is not behaving in compliance with the documentation (Genesys Cloud and GDPR compliance - Genesys Cloud Resource Center), please open a case with Genesys Cloud Care to investigate. We do not have access to your org's data and it would be inappropriate to discuss the details of PII redactions in a public setting, so that discussion has to go through Care.

[Sai_tt]

@tim.smith Today I saw that the phone number data is also deleted on the interaction.

Do you know why it took few more extra days to remove the phone numbers and agent details on the interaction even though the API response gave "COMPLETED" status earlier?

Timeline:

1. Submitted GDPR Delete request on 9/27
2. API Response on "/api/v2/gdpr/requests "showed Status as "COMPLETED" on 10/3
3. When we checked interaction data, only recording and participant data are deleted. Phone number and Agent names still shown on the Interaction.
4. On 10/6, Phone number and Agent/customer names on interactions are changed to random numbers which I think shows as deleted data. Status of the API Response still "COMPLETED"

[tim.smith]

Please see my previous reply. We do not have access to your data via the forum. You must open a case with Genesys Cloud Care if you need investigation into the behavior of a GDPR request.

[Sai_tt]

Thanks @tim.smith . I have opened a case with support on above query. One other question- We are not using any External contacts. To submit a delete request, is the below api request enough to delete all necessary data in Genesys?

{
"requestType": "GDPR_DELETE",
"subject": {
"phoneNumbers": [
"+1XXXXXXXXX"
]
}
}

POST : /api/v2/gdpr/requests

[tim.smith]

@Sai_tt

is the below api request enough to delete all necessary data in Genesys?

I cannot provide legal advice on compliance with GDPR regulations. You will need to review the documentation/performance of the GDPR processes with your legal team to validate that it handles "all necessary data" per your interpretation. Here's some relevant info from the documentation linked above. Providing this FAQ to your legal team should aid them in their analysis.

GDPR service endpoints

The GDPR service exposes two endpoints- a first endpoint for identifying the subjects that a given search term matches, and a second endpoint for actually initiating GDPR requests. The subjects endpoint accepts a single search term of a name, address, phone number, or email address, or social media handle, and returns a list of 0 or more matching subjects that consists of a userId, externalContactId, or dialerContactId. The requests endpoint accepts a single search term and a request type of Get, Export, Update, or Delete for responding to Article 15 (access), Article 16 (rectification), and Article 17 (erasure) requests. The requests endpoint accepts a single search term of a name, address, phone number, email address, social media handle, user ID, external contact ID, or dialer contact ID for initiating the specified GDPR request type. If the term is an ID, then the service first resolves it into the corresponding resource (user, external contact, dialer contact) and includes the known fields in the GDPR request.