LGPD - Process for Requesting and Sending Personal Data stored in LigeroSmart
Available from LigeroSmart 6.0.32 (March / 2021)
LigeroSmart Toro
LigeroSmart allows the creation of several processes to help companies and organizations to comply with regional regulations for the protection of personal data.
In this way, DPOs can use LigeroSmart to securely store requests and processes related to LGPD, GDPR and other regulations. Thus, the organization can guarantee the audit of the process and respect for users who may have questions or requests regarding the use of their personal data.
So we decided to create a series of features linked to data protection and information security. We named this module the LigeroSmart Toro system! LigeroSmart Toro is an integral part of LigeroSmart Community Edition and is therefore also free and open source.
How does the Personal Data Export process work?
In this article, we show a process for exporting personal data (available from LigeroSmart version 6.0.32) already available in Process Management.
The user can request access to the data stored in LigeroSmart and other organization tools from the LigeroSmart customer portal, by sending an email or by phone:
After completing the request, a ticket is created and can be placed directly in an organization's DPO queue.
It is necessary for the DPO to confirm the authenticity and ownership of the applicant. This procedure can be performed in different ways and it is up to the DPO to make this definition.
When the authenticity of the requester is confirmed, the DPO can access the option “LGPD - Confirm Applicant Ownership”:
In the following screen, the ownership must be confirmed:
After confirmation, LigeroSmart Toro generates an article visible to the customer, with an attached report containing the applicant's personal data and then closes the call:
Opening the attached file, we have the following content:
This report currently contains the following sections:
1 - User Information: All data registered in the LigeroSmart database
2 - Client Information: Client's company data
3 - List of user calls
Nice! I want to enable the data export process on my system right now! How do I do?
Go to Administration -> Process Management.
Search for the option “Ready2Adopt processes” in the lower left corner and select “LGPDRelatorioDadosPersonais”. Click on “Import Ready2Adopt processes”:
The system will return 3 warnings:
1 - Importing the process changes some system settings. You will need to enter Administration -> System Configuration and apply these changes.
2 - The system informs you that the process was imported successfully 🙂
3 - The system informs you that you need to implement the imported process. Then click on the button “Deploy all processes”
Important: Do not forget to go to Administration -> System Configuration and apply the changes mentioned in item 1.
Providing the LGPD service -> Requesting personal data on the Client Portal
To make it easier for users to request information and make your company more “Compliance” with LGPD, we suggest making the data request service available on the customer portal.
One suggestion is to create an LGPD or “Data Privacy” category at the root of the Service Catalog:
Upload an image or use one of the system icons. One suggestion is to use the “fa-keycdn” icon as in the image above.
Then, create a sub-service "Request personal data" or "Request report of my personal data" and associate it with the process we imported into the system:
Adjusting the Process
As we said earlier, initially, we delivered a very simple process that consists of filling out the application and validating and confirming ownership:
With confirmation, a transition action “CreateUserHistoryFile” creates an article with the applicant's personal data report attached.
You can orchestrate the export of data from other systems and add it to the LigeroSmart Export Process by creating integrations with the LigeroEasyConnector.
Consult our documentation to understand how LigeroEasyConnector you can get information and documentation from other systems!
In this way, you can control and record all DPO requests within a single tool.
The CreateUserHistoryFile Transition Action
The Transition Action in question receives a set of parameters that must be used to define the layout of the report that will be generated. The parameters are:
- ArticleTitle: It will be the title of the article created by the transition.
- ArticleContent: The text that will be inserted in the article that will be generated by the transition.
- ShowUser: Indicates whether the generated item will be available to the client user: 1 to display, 0 not to display.
- UserDataTemplate: HTML template used to bring User information.
- CompanyDataTemplate: HTML template used to bring the company's information.
- TicketTableHeaderTemplate: HTML template used to bring the ticket table header.
- TicketTableContentTemplate: HTML template used to bring information from Tickets.