[Rt-commit] rt branch, 4.4/add-gdpr-docs, created. rt-4.4.3-150-gad7af74f9a

Jim Brandt jbrandt at bestpractical.com
Thu Dec 20 16:12:10 EST 2018


The branch, 4.4/add-gdpr-docs has been created
        at  ad7af74f9a6834f7d3e11735eb1408e942218681 (commit)

- Log -----------------------------------------------------------------
commit ad7af74f9a6834f7d3e11735eb1408e942218681
Author: Jim Brandt <jbrandt at bestpractical.com>
Date:   Thu Dec 20 16:11:26 2018 -0500

    Add GDPR docs

diff --git a/docs/GDPR.pod b/docs/GDPR.pod
new file mode 100644
index 0000000000..ba384ab5b8
--- /dev/null
+++ b/docs/GDPR.pod
@@ -0,0 +1,121 @@
+=head1 General Data Protection Regulation (GDPR) Support in RT
+
+The General Data Protection Regulation (GDPR) is a new set of regulations passed by the European
+Union taking effect on 25 May 2018. You can read more about the new regulations on
+the L<GDPR website|https://ec.europa.eu/info/law/law-topic/data-protection_en>.
+
+Many of these regulations fall to the web site owner or provider of a service, so they are outside
+the scope of a software solution. However, RT provides some features that make
+compliance easier for organizations who run RT, whatever your internal GDPR policies
+might be.
+
+=head1 Viewing User Data in RT
+
+User data in RT, like name and email address, are typically stored on a user record.
+There are different options to manage how different classes of RT users can view
+and even edit their user information.
+
+=head2 Privileged Users
+
+Privileged users in RT are typically the staff of an organization, so they likely have access
+to their information in RT. If given the ModifySelf right, Privileged users can
+see and modify their full user record at Logged in as > Settings > About Me.
+
+=head2 Unprivileged Users
+
+Unprivileged users will interact with RT via the Self Service interface or through email only.
+These users are typically customers and will have much less default access in RT. Since there
+are many different relationships with end users, RT offers several different options to
+allow Self Service users to view and edit their user data. All of the options below also
+require the users to have the ModifySelf right.
+
+L<RT_Config/SelfServiceUserPrefs> has the following options:
+
+=over
+
+=item C<edit-prefs> (default)
+
+When set to C<edit-prefs>, self service users will be able to update
+their Timezone and Language preference and update their password.
+This is the default behavior of RT.
+
+=item C<view-info>
+
+When set to C<view-info>, users will have full access to all their
+user information stored in RT on a read-only page.
+
+=item C<edit-prefs-view-info>
+
+When set to C<edit-prefs-view-info>, users will have full access as in
+the C<view-info> option, but also will be able to update their Language
+and password as in the default C<edit-prefs> option.
+
+=item C<full-edit>
+
+When set to C<full-edit>, users will be able to fully view and update
+all of their stored RT user information.
+
+=back
+
+=head1 Downloading User Data
+
+RT provides several different options to download user data to format-neutral
+tsv files. These options are available to administrators on the user admin
+page at Admin > Users > Select > [find a user].
+
+=head2 Download Core User Data
+
+This option providesa file with basic user information from RT. The
+format of the download can be modified by setting L<RT_Config/UserDataResultFormat>.
+
+=head2 Download User Tickets
+
+This option provides a file with ticket summaries for all tickets that have
+the selected user as a requestor. The ticket summary file format can be
+configured with L<RT_Config/UserTicketDataResultFormat>.
+
+=head2 Download User Transactions
+
+This option provides transaction summaries for all transactions on which the
+selected user is the creator. This will typically be all of the correspondence
+where they replied back to a ticket, so it contains their part of ticket
+conversations. The format can be configured with L<RT_Config/UserTransactionDataResultFormat>.
+
+=head1 Removing User Data
+
+One provision of GDPR gives users the "right to be forgotten" which means they can
+request that their data be removed from an organization's system. RT provides several
+options to remove data associated with a user. These use the L<RT::Shredder> tool, but
+links are provided from the user administration page to make removal easier.
+
+=head2 Anonymize User
+
+This option will clear all data on the user record for the current user,
+while preserving the user record. The required fields for a user are set
+to anonymous values.
+
+This option leaves all tickets intact, but the personal information, like
+email address, stored on the user record is removed.
+
+It is important to note that this action will not remove user information
+from ticket bodies or email headers, only data from any RT-based sections like
+People. To anonymize ticket data, RT provides a script C<rt-munge-attachments>
+which you should also run. It is not linked from the web UI because it can
+require a long time to run.
+
+=head2 Replace User Information
+
+This option uses shredder with the replace_relations option to replace the
+existing userid with the RT user "Nobody" in transactions and other records
+that have the id. The user record is then completely deleted.
+
+To replace with a user other than Nobody, update the replace_relations option
+once on the shredder page.
+
+=head2 Remove User Information
+
+This option uses shredder to completely remove the user and connected data by running
+it without the replace option. Note that this option will delete tickets and
+ticket data from your system. See L<RT::Shredder> for more information.
+
+=cut

-----------------------------------------------------------------------


More information about the rt-commit mailing list