Configure DSR Request Policies

What is DSR request policy?

A DSR request policy (separate from a CI Policy, used for automated policy checks in CI) is a set of instructions, or Rules, that are executed when a user submits a request to retrieve or delete their data. It describes how to access, mask, or erase data that matches specific data categories in submitted privacy requests.

Each endpoint takes an array of objects to create multiple policies, rules, or targets at one time.

Create a Policy

To create a new DSR request policy, it must first be defined:

[
  {
    "name": "User Email Address",
    "key": "user_email_address_policy",
    "drp_action": "access", // optional
    "execution_timeframe": 7
 
  }
]

Policy attributes

Add a Rule

The policy creation operation returns a DSR request policy key. This key can be used to add a Rule to the DSR request policy. Rules represent a series of information and actions to take when a privacy request of the corresponding action_type is submitted.

The following is an example of an access Rule:

[
  {
    "name": "Access User Email Address",
    "key": "access_user_email_address_rule",
    "action_type": "access",
    "storage_destination_key": "storage_key"
  }
]

Rule attributes

Add a Rule Target

A Rule also specifies one or more Data Categories (opens in a new tab), or "Targets", to which the rule applies. Creating a Rule will return a key, which can be used to assign it one or more targets:

[
  {
    "name": "Access User Email Address Target",
    "key": "access_user_email_address_target",
    "data_category": "user.contact.email",
  }
]

Add an erasure Rule

The access DSR request policy created above will pull all data of category user.contact.email. In the event of an erasure request, we might also want to mask this information.

A new erasure rule can be added to the same DSR request policy:

[
  {
    "name": "Mask Provided Emails",
    "key": "mask_provided_emails",
    "action_type": "erasure",
    "masking_strategy": {
      "strategy": "hash",
      "configuration": {
        "algorithm": "SHA-512"
      },
    },
  },
]

This will create a Rule to hash an unspecified value with a SHA-512 hash. To add a value to hash, create a new Target for this Rule:

  [
    {
      "data_category": "user.contact.email",
    },
  ]

This DSR request policy, user_email_address_policy, will now do the following:

• Return all data with a data category that matches (or is nested under) user.contact.
• Mask all data with data category that matches user.contact.email with a the SHA-512 hashing function.

Erasing data

When a DSR request policy Rule erases data, it erases the entire branch given by the Target. For example, a user.contact Rule, will erase all of the information within the contact node, including user.contact.email.

It's illegal to erase the same data twice within a DSR request policy. For example, erasing user.contact and user.contact.email is not allowed.

Default DSR request policies

Fides ships with two default DSR request policies: download (for access requests) and delete (for erasure requests).

• The download DSR request policy is configured to retrieve user data and upload to a local storage location.
• The delete DSR request policy is set up to mask user data with the string "MASKED".