Responding to GDPR Requests

Iterable provides API endpoints that can help you respond to General Data Protection Regulation (GDPR) right of access and right to be forgotten requests.

# Table of contents

# Iterable's API

First, learn about Iterable's API:

• API Keys
• API documentation

# Right of access requests

To export a user's data from a particular Iterable project, use an API key for that project to call GET /api/export/userEvents and GET /api/users/{email}.

Call these endpoints for each project from which you'd like to export the user's data.

# Right to be forgotten requests

To respond to right to be forgotten requests, Iterable allows you to:

• Delete users
• Forget users (which also deletes them)

# Deleting users

To delete information about a user from an Iterable project, use an API key for that project to call one of the following APIs:

• DELETE /api/users/{email}
• DELETE /api/users/byUserId/{userId}

Deleting a user does not prevent Iterable from collecting more data about the user (if it's received).

# Forgetting users

The POST /api/users/forget API does two things:

• Deletes the user's data from the Iterable project.
• Prevents Iterable from collecting more information about or sending messages to that user.

For a given user, call this endpoint for each project necessary.

# Listing hashed email addresses of forgotten users

To get a list of hashed email addresses associated with users forgotten by an Iterable project, use an API key for the project to call GET /api/users/forgotten.

To check if the list of hashed email addresses contains a particular email address:

• Lowercase the email address or ID.
• Strip out all whitespace.
• Calculate the SHA-256 hash.
• Check the list for the hashed value.

Iterable is unable to provide you with a list of forgotten users.

# Further reading

• Deleting Users
• DELETE /api/users/{email}
• DELETE /api/users/byUserId/{userId}
• POST /api/users/forget