General data protection regulation and the right of erasure

General data protection regulation (GDPR) sets forth a set of rules to be observed with regards to the right of erasure.

The right of erasure

The right of erasure, also known as the right to be forgotten, allows data subjects to request the removal of their personal data. Erasure requests can be made when data subjects withdraw their consent or when the processing is no longer necessary for the purposes it was collected for.

However, controllers may deny erasure requests if they can assert that the data may be useful for current business purposes.

Definitions

• Controllers = SAP customers using SAP Build Process Automation, Foundation add-on by UiPath
• Data subjects = any current or former agents, employees, customers of the customers

How to exercise the right of erasure as a customer

When a data subject requests that a controller remove their personal data, the following steps must be taken:

1. The controller analyses data subject's request and determines what personal details should be removed.
2. The controller makes a request by opening a support ticket and specifying the following identification information:
   • name
   • email address

Removal of personal data

Once the request is approved, personal data is removed in accordance with UiPath's internal processess.

All personal data is replaced with randomized texts, thus making the identification of the requester impossible.