Personal data (erasure at the data subject's request)

Gobierno › Datos personales (Governance › Personal data) lets you handle a person’s request to erase their data —the right to erasure under habeas data (Colombian Law 1581 of 2012)— from one place: you search by one piece of data, see where it appears, decide what to do and download a certificate to answer them. The search and the erasure also reach the archived batches, so your answer covers everything your organization keeps in Zoan Cloud or in your own container.

It is available on every plan. Using it requires the data_subject:manage permission (search for and erase or anonymize a person’s data at their request, with a certificate), which comes with the Owner and Administrator roles; you can add it to one of your organization’s roles, for example your data protection officer’s.

Handling a request

1. Register the request: enter the person’s data and the request’s reference (for example, the filing number).
2. Search: Zoan Cloud goes through active and archived data and shows the preview.
3. Choose the action: Suprimir (Erase) or Anonimizar (Anonymize), and confirm it by typing SUPRIMIR or ANONIMIZAR.
4. Download the certificate as a PDF to answer the person and keep it with the request.

The data you search for

The search uses one piece of the person’s data:

Data	How it is matched
Email	As written, ignoring case.
Phone	With or without spaces, dashes, parentheses or country code: +57 300 123 4567 also finds 3001234567.
ID number	With or without dots: 1.020.304.050 also finds 1020304050.
Other text	Any other data that identifies the person, such as a full name or a customer number.

Where it searches

Where	What is checked
Assistant conversations	Messages and actions.
Booked appointments	The appointment and its data.
Human tasks	Form and response.
Zoan Flow cases	Start form, steps and events.
Queue items	The item’s data.
Executions	The step-by-step log.
IDP documents	Name, reference and extraction.
Storage files	The file name.
Archived batches	The records in each batch, in Zoan Cloud or in the current container.

The preview

Before anything changes you see, for each kind of data, how many records contain the data, which are still in progress and a few examples to confirm the search found the right person, plus how many records are in archived data.

Erase or anonymize

Action	What it does
Suprimir (Erase)	Deletes the finished records that contain the data.
Anonimizar (Anonymize)	Replaces the data with [dato suprimido] wherever it appears and keeps the rest of the record: your operation’s figures and traceability stay intact.

IDP documents and storage files are deleted with either action, because the data is inside the file.

In archived data, each batch that contains the data is rewritten without those records (or with the data replaced), verified, and its new sha256 is recorded in the Data retention history, so the batch stays verifiable.

What is still in progress

An open conversation, a pending task, a running case or execution, an unprocessed item or a future appointment is left untouched, so the operation is not interrupted. The preview and the certificate list them: once they finish, search again and complete the request.

The audit log

The audit log is not modified: it is a retention obligation and does not store the records’ content. Every step of the request is written to it without the data, only its masked version and its sha256 fingerprint:

Event	When
data_subject.request_created	The request is registered.
data_subject.searched	The search runs.
data_subject.confirmed	The action is confirmed.
data_subject.applied	The action is applied.
retention.archive_rewritten	An archived batch is rewritten.
data_subject.certificate_downloaded	The certificate is downloaded.

The certificate

When the request is done, the searched data is removed from the request and you download a PDF certificate with:

• The organization, the request and its reference.
• The masked data and its sha256 fingerprint.
• What was done in active and in archived data.
• What remained in progress.
• Who requested the action and who confirmed it.

Next steps

• Data retention — how long each kind of data stays active and how it is archived.
• Governance — AI governance, AI usage and Audit.
• Organization and SSO — the personal data policy the AI masks.