Overview

GDPR and CCPA both give people rights over data collected about them, and both distinguish the business that decides what to collect (data controller under GDPR, business under CCPA) from the service that processes it on the business's behalf (data processor under GDPR, service provider under CCPA). Intempt acts as your data processor: you decide what to collect and how long to keep it, and Intempt gives you the tools to act on the two things regulators actually check: consent and data subject requests (DSRs).

This guide covers both from one place: reviewing and changing a customer's consent on their Privacy tab, and how DSRs (erasure, access, export) work under the OpenDSR framework Intempt implements.

📘 Good to know

This guide covers the compliance workflow end to end. For the full consent category taxonomy and SDK tracking reference, see Managing consents. For DSR request types and SLAs in detail, see Managing DSR.

How it works

Consent

Every consent or rejection your app tracks is recorded as an event through the SDK's consent() method, with a category (which policy the event applies to, like "newsletter"), an action (accept or reject), and a timestamp. That record is what builds the consent status you see per customer.

Legitimate interest

Some processing doesn't need active consent. If your lawful basis is legitimate interest (for example, subscription communication), Intempt still gives customers a way to object, per GDPR Article 21. Legitimate interest categories are managed with the same toggle mechanic as consent categories, just under a separate section so the two lawful bases aren't confused with each other.

Data subject requests

Both GDPR and CCPA give people the right to have their data erased, accessed, or exported. Intempt implements this through OpenDSR (formerly OpenGDPR, renamed in 2020 to add CCPA support), which defines three request types:

See Managing DSR for the full request workflow.

Getting started

Use the customer's own record to check and change their consent. This is the day-to-day compliance workflow for a single customer, for example after they email support asking to be opted out.

1. Open the customer's record from the Users list and click the Privacy tab.

2. Consent status. The top card shows every category the customer has been asked about, split into Consented and Revoked, with the date it was last updated.
3. Consent categories. Each active consent category is listed with a toggle. Switching one on takes effect immediately. Switching one off opens a confirmation dialog titled Reject consent?, reading: "This will reject the user's consent for this category. The user will no longer receive communications for this category and this action will be logged for compliance purposes." Click Reject consent to confirm, or Cancel to back out.

4. Legitimate interest. Below the consent categories, this section lists any categories processed under legitimate interest rather than active consent, with the same toggle-and-confirm mechanic. Use this section when a customer objects to legitimate-interest processing under Article 21.
5. To act on a full erasure, access, or export request instead of a single category change, follow Managing DSR. DSRs go through Intempt directly rather than the Privacy tab.

Use cases

1. A customer emails support asking to stop receiving marketing emails. Reject their "Newsletter" consent category on their Privacy tab.
2. Confirm a customer's current consent status before adding them to a new campaign.
3. Process a right-to-erasure request within the OpenDSR SLA (7-day cancellation window, up to 14 days to complete).
4. Fulfill a CCPA access request by exporting a customer's data.
5. A customer objects to legitimate-interest processing under Article 21. Reject the relevant category in the Legitimate interest section.
6. Audit a customer's consent history as evidence of consent if a regulator or the customer disputes it.
7. Distinguish customers who gave active consent from those processed under legitimate interest, so you don't ask them to consent to something they don't need to.
8. Apply the same DSR workflow to CCPA consumer requests as GDPR data subject requests: Intempt's OpenDSR implementation covers both.

Where to go next

• Managing consents

• Consents

• Managing DSR

• Data Subject Requests

• Preference center

• Managing the preference center