View source for Information Request Workflow in Privacy Component

Information requests are the central element to the privacy component and processing user requests for their data to be exported or removed from a site.

== Creating a Request ==

A request can be created either by a super user for the website or an authenticated user through the request form.

{{note|''IMPORTANT'' To create and process information requests, your website MUST be able to send emails due to the requirement for the information owner to confirm the request.|type=notice}}

=== Super User Creation ===

Through the '''Privacy: Information Requests''' screen, any super user may create a new information request.  This is the only way to create information requests for users who do NOT have accounts on the website.  To create a request, the super user must specify:

* The email address of the user for whom to process data
* The request type (export or remove)

Note: In this context, a user means any individual or organization who has made a request, regardless of whether there is a registered user account on the site for a user (as an example, this would allow the tool suite to process requests for sites which have a commenting system which allows guests to comment by providing a name and/or email address without requiring to be registered on the site).

=== Authenticated User Request ===

Registered users may submit information requests for their accounts on the website.  It is suggested to create a '''Privacy > Create Request''' menu item to link to the information request form.  When submitting an information request, the user must provide:

* Their email address
* The request type (export or remove)

== Confirming a Request ==

Once a request has been created, regardless of how it is created, the user must confirm that this is a valid request for their information. They will receive an email from the website alerting them to the request's creation and be provided a link to a confirmation form where they will need to enter the token provided in the email and their email address to confirm the request's validity. Once the user confirms the request, it will be marked as '''Confirmed''' in the component's requests list and the site's super user(s) will be able to process it.

The token in this email is valid for 24 hours. If a request is not confirmed in that timeframe, the request will be marked as '''Invalid''' in the component's requests list and a new request must be submitted.

It is suggested to create a hidden '''Privacy > Confirm Request''' menu item in order to provide a SEF URL for this page, however this is not required.

== Processing a Request ==

=== Export Request ===

[[File:Info Request Export-en.png|600px|none]]
Once an export request has been confirmed, there are two actions available to super users.

* Export Data: This will collect all data for the information request's subject and create a XML file that will be downloaded to your computer.  This is useful to enable site owners to review the data export prior to sending it to the user.
* Email Data Export: This will collect all data for the information request's subject, create a XML file (the same as generated by the Export Data action), and send an email to the user with the exported data file attached.

{{note|''Important'' The export action can only process data from supported extensions. Therefore, the super user who is acting on the request should review the export and if necessary include data that was not processed from extensions.|type=notice}}

=== Removal Request ===

[[File:Info Request Remove-en.png|600px|none]]
Once a remove request has been confirmed, there is one action available to super users.

* Delete Data: This process will anonymize and/or remove data related to the information subject. For requests where the information owner also has a registered user account, this process will anonymize the account's name, username, and email address, as well as block the account from being logged into and log the user out of the site if they are logged in at the time the request is processed.

{{note|''Important'' The delete action can only process data from supported extensions. Therefore, the super user who is acting on the request should review the site after the removal is completed and if necessary manually anonymize or remove data that was not processed from extensions.|type=notice}}

== Completing a Request ==

After the request has been processed, the request should be marked as completed. This will indicate that the request has been fulfilled and there is no further action to be taken.

== Additional Resources ==

* [[S:MyLanguage/J3.x:Integrate Extensions with the Privacy Component|Developer's Guide for the Privacy Tool Suite]]

<noinclude>
[[Category:Privacy{{#translation:}}]]
[[Category:Components{{#translation:}}]]
[[Category:Joomla! 3.9{{#translation:}}]]
[[Category:Plugins{{#translation:}}]]
</noinclude>