Data deletion request procedure
Here’s the standard procedure for handling data deletion requests, typically aligned with privacy regulations like the GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act):
1. Request Submission
Method: Users or administrators submit a data deletion request through one of the designated channels (e.g., email, in-app form, or customer support portal).
Verification: Upon receiving the request, the identity of the requester must be verified. This could involve verifying the email address, account ownership, or administrative status, especially when the request is made by a Slack workspace admin.
2. Acknowledgment
Confirmation: The request is acknowledged, and the user is informed of the process and timeline (typically within 7-30 days, depending on the applicable law).
Case ID: A case or reference number is provided to track the request.
3. Data Review
Data Identification: Relevant data associated with the user (e.g., Slack user ID, email address, message history, and other retained data) is identified across databases, logs, and any integrated third-party services.
Scope Validation: Ensure that the data deletion request complies with retention requirements. For example:
Some data might need to be retained for compliance with legal obligations (e.g., tax records, audit logs).
Only data specifically related to the requester or their alerts will be processed.
4. Data Deletion
Secure Deletion: Once identified, the user’s data is deleted securely from all systems. This includes:
Primary systems: Removing data from active databases and servers.
Backups: Ensuring data is either excluded from future backups or permanently deleted after retention period ends.
Third-party services: Informing or requesting deletion of user data from third-party systems integrated with the bot (if applicable).
Anonymization: In cases where complete deletion isn’t feasible (e.g., in audit logs), personal identifiers are anonymized to protect the user’s privacy.
5. Confirmation of Completion
Notification: The user is notified when the data deletion process is complete.
Report: Optionally, a summary report can be provided to confirm which data has been deleted or anonymized.
6. Documentation
Internal Record: A record of the deletion request, its processing, and the outcome is maintained for audit and compliance purposes, without retaining the actual deleted data.
HIPAA compliant
yes
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.