GDPR disclosure & deletion for a contact

When do you need this?

If someone formally requests information under Art. 15 GDPR or deletion under Art. 17 GDPR, you must respond within one month. Chorilo offers both as separate workflows.

Disclosure (Art. 15 GDPR)

1. Open the contact's detail view.
2. Click GDPR disclosure.
3. The JSON file is downloaded — contains master data, tags, all links to invoices, transactions and events plus metadata.

The action is logged in the security audit log with user ID, IP and timestamp.

Deletion (Art. 17 GDPR, "Right to be forgotten")

1. Open the contact's detail view.
2. Click GDPR deletion (red button on the right).
3. Confirm by typing DELETE into the confirmation field.
4. Click Delete permanently.

What Chorilo does automatically:

• Cashbook transactions: name, IBAN and address are transferred into the transaction if empty there. Manually set values stay untouched.
• Invoices and manual invoices: recipient data are filled in where empty.
• Event links: removed without replacement.
• Then the contact record (including tags and links) is hard-deleted — irreversibly.

The action is logged in the security audit log with statistics (number of documents, unlinked references) — useful for your own documentation.

Soft archiving vs. GDPR deletion

Archive only hides the contact and can be undone any time. GDPR deletion removes it permanently. Every formal Art. 17 request requires the real deletion.