Data & Privacy
What this page is — the two tools for a data-subject request about someone who appears on your documents: export everything Papers holds against their email, and erase it — with a report of what the law required you to keep.
What it is for — so a subject-access or erasure request is answered completely, from one screen, with a record you can show.
The problem it solves — a data-subject request means searching every document by hand, with no record of what was found or why some data was kept.
Route: /org/settings?tab=papers → Data & Privacy · Permission: Data & Privacy tools for Orbit Papers: export everything held about a counterparty email (GDPR subject access, FB-185) and request erasure with a legal-hold/retention withheld report (FB-186)..
1. What it is
Both tools take one email address, because that is how an external person is identified on a document.
Export returns a JSON file of everything Papers holds against it:
| Section | Contains |
|---|---|
| Party records | Kind, role, name, email, when added |
| Document | ID, title and state of each document they are on |
| Comments | Kind, body and status of each comment they wrote |
| Signature events | The hash-chained ceremony events where they signed |
Erasure handles each matching party record one of two ways:
| When | Result |
|---|---|
| The document is under legal hold, or inside its retention period | Withheld — untouched, and reported with the reason |
| Otherwise | Anonymised in place |
Anonymising means:
| Data | Becomes |
|---|---|
| Name | REDACTED |
| Removed — so a later export can never re-match the row | |
| Portal and signing magic links | Invalidated |
| Their comment bodies | [erased] |
| Signature evidence — IP, user agent, location, chained events | Kept — legal proof of signing |
Both the withholding and the kept evidence rest on the same basis: legal obligations take precedence over erasure (GDPR Art. 17(3)).
It is scoped to Papers. Data about the same person in the CRM or elsewhere is that module's to export.
2. Why you would use it
- The deadline is met from one screen. No hunting through hundreds of agreements.
- The export is complete by construction — every party row for that email, with its context.
- The withheld report is the honest answer. "We erased everything" is wrong if a legal hold kept some of it; the report says what remains and why.
- Signing proof survives. Anonymising a signer does not break the evidence that a contract was signed.
3. Step by step
Export
- Enter the email.
- Export. A JSON file downloads: "Export downloaded — n record(s) found".
Erasure
- Enter the email.
- Enter the reason — required, and written to the audit trail.
- Confirm.
- Read the report: what was erased, and what was withheld with each reason.
4. Field reference
| Field | Rules | Message |
|---|---|---|
| The subject's address | — | |
| Reason (erasure) | Required | A reason is required for erasure (it is written to the audit trail) |
| Report item | Means |
|---|---|
| Erased count | Party records anonymised |
| Withheld list | Each withheld record's document, party and why — legal hold or retention |
The report distinguishes an erasure where nothing was erased because everything was withheld — it does not present that as a success.
5. Handling a request end to end
The two buttons are the easy part. The request is answered by the process around them.
- Verify the requester's identity outside Orbit. The tools trust whatever email you type — an erasure run for the wrong address anonymises someone else.
- Collect every address they used. Export and erasure work per email. A person who signed with a company address and commented from a personal one has two sets of records.
- Export each address and keep the files with the request.
- Gather other modules' data. This screen covers Papers only — CRM contacts, service desk tickets and storefront accounts have their own tools.
- Check holds and retention with the records owner before erasing, so the withheld report holds no surprises.
- Run erasure with a reason that names your request reference.
- Reply with the exports, the erased count, and each withheld record with its legal basis.
- Diarise the withheld records. When a hold is released or retention ends, run erasure again for the same address — nothing re-runs it automatically.
Edge cases
| Situation | What happens | What to do |
|---|---|---|
| The person used two addresses | Each is a separate subject as far as the tool knows | Run both |
| A record is withheld | Its party row, and that party's comments, are left as they are | Record the basis; re-run later |
| The person signed a document | Their signature evidence is kept even when the party row is anonymised | Explain that it is retained as proof of signing |
| An export returns nothing | That address is not a party on any document | Try their other addresses before replying "no data" |
| The erasure was run on the wrong address | Anonymisation cannot be undone | Verify identity first — step 1 |
6. Worked example
A former supplier contact, Marcus Feld, sends a subject-access request followed by an erasure request.
Export for [email protected] returns 4 records: party on three NDAs and one services agreement, two
comments, and the signature events from the services agreement he signed.
Erasure with reason "GDPR Art. 17 request received 3 Sept 2026, ticket DPO-118":
| Document | Result | Why |
|---|---|---|
| NDA 2023 | Erased | — |
| NDA 2024 | Erased | — |
| NDA 2025 | Withheld | Inside retention until 2031 |
| Services agreement | Withheld | Under legal hold — active dispute |
The DPO replies to Marcus with the export, confirms two records erased, and states that two are retained, each with its legal basis — which is exactly what the report gave them.
7. The admin contract
| Must be true | Where | What breaks without it |
|---|---|---|
| The role holds Data & Privacy tools for Orbit Papers: export everything held about a counterparty email (GDPR subject access, FB-185) and request erasure with a legal-hold/retention withheld report (FB-186). | Role editor | The section is missing |
| Retention dates and legal holds are recorded | Records | Records that must be kept are erased |
| Requests are logged with a reference | Your DPO process | The reason in the audit trail cannot be traced |
| Other modules handle their own data | Their privacy tools | The response covers Papers only |
8. Downstream
| After erasure | Then |
|---|---|
| Anonymised parties | Their magic links stop working |
| Documents | Unchanged in body; parties show REDACTED |
| Later exports for that email | Do not find the anonymised rows |
| Withheld rows | Stay until their hold is released or retention ends — erase again then |
9. Don't confuse this with…
| Redaction | Hides data in an outbound copy. Erasure removes it |
| Disposition | Destroys records on a schedule |
| Revoking a share link | Cuts access to one document |
10. Troubleshooting
| Symptom | Cause |
|---|---|
| The export is empty | That email is not a party on any document |
| Erasure withheld most records | Legal holds and retention take precedence |
| Erasure refused | No reason entered |
| The person still appears in the CRM | This tool covers Papers only |
| Signature evidence still shows their IP | Kept deliberately as proof of signing |