Customer has requested to be forgotten
A customer is in a legal dispute with the distribution company and requests that all instances of their name be forgotten within the application. Because this action destroys data on the customer record that cannot be recovered, you must perform certain tasks before taking the GDPR action on this customer.
A review of all orders for the customer must be performed. You must have a policy for handling these scenarios:
- Orders that have been entered, but not shipped
- Orders that have been shipped, but not invoiced
- Invoices sent but not paid
After the customer is forgotten, your company can no longer work with the sales orders for that customer.
Perform a review all transactions and balances for the customer. You must have a policy to address open transactions and non-zero balances in the most expedient way possible.
After you review and update data related to the customer and the use of that customer record throughout the application, begin processing the request. In SA GDPR Compliance Administration, perform an initial search on the name that was provided. Based on the number of results returned, you can use the facet search to add additional search criteria to reduce the number of results.
Select all the confirmed records and click the button. Specify an expiration date that reflects how long the forgotten records can remain in the system before they are required to be removed. When you click , the processing to redact the personal data begins in the system.
After the redaction process is complete, that customer record and any ship to records for that customer cannot be edited. The records are not visible in the customer or ship to lookups. No sales orders for the customer can be created or maintained. In other functions, such as Product Warehouse Description Setup where the Customer field is associated with a warehouse, that customer number cannot be specified.
Use the Expiration view in SA GDPR Compliance Administration to keep track of forgotten records that are approaching the specified expiration date. You are responsible for ensuring that the records are deleted. When you are ready to delete the customer record, you must select the instances in the Expiration view and re-enable the instances so the record can be accessed and deleted.
Monitor the time between the enablement and the deletion. The time frame must be as small as possible so that the records with the destroyed data are not used anywhere in the application. If a different Data Protection specialist deletes the Customer Setup and Customer Ship To Setup records, you must coordinate to ensure a short time frame.