from SuiteCRM and GDPR - SuiteCRM
Is this enough for GDPR? Don’t we have to make sure in the future that the information is deleted from the database for good?
What’s the idea behind “you can set up a workflow to do this automatically”?
Remember, you (or your company) does GDPR, SuiteCRM is only the tool that tries to make that job easier for you 
I think the mentioned Workflow would be one triggered by the “opt-out” status change, or any other status change you define, and the workflow deletes the Account / Person.
I am afraid deleting data from a CRM is not an easy thing, there is no one-size-fits-all recipe. You need to decide which related records to keep, which to delete along with the main Account / Person. So you should have a “deleting policy” and think of ways to enforce it, some can be mechanic like a Workflow, others might require human intervention (like a Workflow generating a task for a user to “go and delete all related records of X account that you think are wise to delete”).
Thanks for your answer. I’m still trying to grasp GDPR.
My question related mainly to how SuiteCRM marks items as deleted in the database, but doesn’t actually delete them. I’m wondering if that is all that’s required for GDPR. But it seems it probably is.
Opting out of an email-newsletter e.g. is to my understanding not the same thing as having to delete a record entirely. Afaik that would be a separate user action, asking to be entirely erased from the database.
I agree we need to think through our processes for these types of user actions (including the data export requirement of GDPR)
Yes, there is one aspect you mention which I didn’t think of - the fact that deleted records still exist, with “deleted=0”.
But there is a pruning job that you can run as often as needed, which removes these completely.
1 Like