GDPR / Data Privacy
The Data Privacy vertical is included on the Enterprise plan.
Scope
Behavry's Data Privacy module maps GDPR requirements relevant to AI agent workflows that process personal data. The goal: every time an agent touches PII, there's a defensible record of who authorized it, what data was involved, what redaction was applied, and where the output went.
Source: backend/behavry/compliance/data_privacy.py. UI: Compliance → Data Privacy (GDPR).
Covered requirements
| Article | Requirement | Behavry answer |
|---|---|---|
| Art. 5(1)(c) | Data minimization | DLP Scanner auto-redaction, Data Protection Pipeline (metadata-only mode) |
| Art. 5(1)(f) | Integrity & confidentiality | Decision Trace hash chain, encrypted SIEM destinations |
| Art. 25 | Data protection by design | Policy-gated tool calls, default-deny OPA posture |
| Art. 30 | Records of processing activities | Audit log with categories, purpose tags, recipients |
| Art. 32 | Security of processing | Role-based access, SSO, Restricted Mode, Global Kill Switch |
| Art. 15 | Right of access | DSAR access export (see below) |
| Art. 17 | Right to erasure | DSAR anonymize-in-place erasure (see below) |
| Art. 33 | Breach notification preparedness | Behavioral alerts, incident timeline in Decision Trace |
PII pattern coverage
The GDPR module activates an EU PII pattern set:
- Email addresses with domain risk tagging
- Phone numbers (E.164 and national formats)
- National ID numbers — DE (Steuer-ID), FR (INSEE), IT (codice fiscale), ES (DNI/NIE), etc.
- IBAN
- Passport numbers
- IP addresses (GDPR treats these as personal data)
Tagged gdpr:pii so policies and inbound rules can target the tag directly.
Data subject rights (DSAR)
Behavry implements the two data-subject rights that operate over the audit trail. A data subject is the natural person attributed to an event via requester_id (the human who instructed the agent) or user_identifier (the browser-extension human identity). Opaque agent/session UUIDs are not treated as subject identifiers.
Both endpoints are admin-only, tenant-scoped, and write an immutable audit record of the request. The subject identifier is never echoed into the erasure record — only a SHA-256 hash is stored — so honoring a request does not re-introduce the personal data being removed.
Source: backend/behavry/audit/dsar.py, backend/behavry/admin/dsar_routes.py. UI: Settings → Privacy (or Compliance → Data Privacy).
Right of access (Art. 15)
Returns the personal data held about a subject within the tenant — most recent first, with the full match count so you know whether the export was truncated:
POST /api/v1/admin/privacy/dsar/access
{ "subject_id": "alice@example.com", "limit": 1000 }
Returns a total_events / returned_events / truncated summary plus the matching audit events (action, target, tool, MCP server, policy result, requester, payload disposition). Encrypted payloads are reported but not decrypted inline — an operator uses the decrypt endpoint (which has its own audit trail) when disclosure of content is required.
Right to erasure (Art. 17)
The audit log is intentionally append-only (hash-chained, integrity-checked), so rows are never deleted. Erasure instead anonymizes in place:
POST /api/v1/admin/privacy/dsar/erase
{ "subject_id": "alice@example.com", "reason": "GDPR Art. 17 request #1234", "dry_run": false }
- The request/response payloads, redacted/encrypted blobs, DLP findings, instruction hash, and the two natural-person identifier columns (
requester_id,user_identifier) are nulled;payload_purged_atis stamped. - Hash-bound fields (timestamp, agent_id, session_id, action, target, policy_result, input_hash) are never altered, so chain verification still passes — exactly as it does after a retention purge.
dry_run: truereports the match count without modifying anything.
This removes the direct personal identifiers and content while preserving tamper-evidence — the defensible "anonymize in place" approach for an immutable ledger. Confirm applicability with counsel for your specific regime.
Export
GET /api/v1/compliance/data-privacy/export?format=pdf|csv|json