# Privacy requests

> Handle requests to erase a person's data from Unifuse: how requests arrive, the dry run, what is erased and what is kept, and what your institution must do in its own systems.

Source: https://docs.unifuse.ai/administration/privacy-requests/

The **Privacy requests** tab is where an institution reviews and carries out erasure
requests from people whose data Unifuse holds.

## Before you start

- You need the *manage privacy requests* permission.
- Open **Administration → Privacy requests**.

## How requests arrive

- A user chooses **Request erasure** on their own profile. See
  [Your account](/getting-started/your-account/#my-profile).
- An administrator logs a request received by other means with **Log a request received
  outside the app**, giving the **Subject's email** and, optionally, a **Phone**, which is used
  only to find text messages.

Each request gets a reference beginning `ER-` and a due date 30 days after it was received.
Administrators are emailed when a request arrives (this email cannot be muted), and the bell
in the header shows open requests.

## The list

Columns are Reference, Subject, Received, Due and Status. Overdue requests are marked.
**Review** opens an open request; **View** opens a closed one.

## Review and erase

1. Select **Review**. Unifuse runs a dry run and shows what would be erased: a count of rows
   by table, a section headed **What is kept, and why**, and any uploaded documents matched by
   the person's name. Each document has a toggle so you can include or exclude it.
2. To proceed, select **Erase** and type the subject's email address back to confirm. The
   erasure runs as a single operation and cannot be undone.
3. To refuse, select **Decline** and give a reason.

## What is erased and what is kept

- The person's student and applicant records, messages and conversation history are deleted.
- A Unifuse user account is scrubbed of personal data and deactivated rather than deleted,
  so the audit trail of what that account did stays intact.
- Opt-outs are kept as a suppression record, so the person is not contacted again.
- The audit log is never altered.

## In your own systems

Unifuse holds a copy of data from your student information system and your identity
provider. Remove the person there too; otherwise the next sync or sign-in re-creates their
records.

## Related

- [Data policy](/administration/data-policy/)
- [Trust: data handling](/trust/data-handling/)