Personal data (Decree 13)
XBuddy records and warns rather than blocking daily work. Personal data is hidden from people without access, consent is logged, and requests from the people the data belongs to are tracked against a 72-hour handling target.
When to use
- A customer, candidate, lead or employee asks to export, erase or stop consent for their data.
- You need to know who can see salary, attendance location or photos, and ID numbers.
- You are preparing for a Decree 13 review.
Before you start
| Item | Detail |
|---|---|
| Screen | Privacy requests are handled at /settings/privacy |
| Access | Handling requests needs the privacy management permission; the exact key is set in your role templates |
| Consent ledger | Consent is recorded where data is collected, such as the careers page and website forms |
| Masking | Salary and attendance location or photos are hidden from viewers without access; the employee always sees their own |
Hiding personal data keeps the business part. A viewer without access sees the personal field empty with a hidden flag, while clock-in and clock-out times and the verified status stay visible so approvals keep moving.
Steps
Receive the request
Employees submit their own request from their account. For customers, candidates and leads who write or call you, a handler records the request on their behalf and finds the person through the privacy subject search, which shows masked contact details only.
Check the open request
Each person can have one open request per type. Submitting again returns the existing request instead of creating a duplicate.
Handle within 72 hours
Everyone who holds the privacy management permission is notified when a new request arrives. Process it within 72 hours.
Complete the request
For export, prepare the data. For erase, the person is anonymized; this is available for candidates and contacts. An employee erase request is declined because records must be retained. For withdraw consent, the consent record is updated and tracking stops.
Sealed ID numbers
Bank account numbers, national ID, passport, tax code and dependant identifiers are encrypted when stored. Screens and exports show a masked value such as the last four digits. To see a full number, use the reveal action on the employee record. Every reveal is written to the audit log first; if the log entry cannot be saved, the number is not shown.
Tips & common mistakes
- Do not email full ID numbers; use the masked value unless a reveal is genuinely needed.
- An employee erase request will be declined; explain the retention obligation to the requester.
- Check who holds the viewing permission before widening access to salary or attendance evidence.