Erase personal data from records

Personal data are stored in fields in account (user) and survey (customer) records as indicated by the Personally Identifying Data field option.

To erase personal data from records, use the AccountGdpr or SurveyGdpr importer plugin. These plugins:

Ingest a feed file that identifies the records to clean.
For each identified record, the plugins:
1. Clean all of the fields marked with the Personally Identifying Data field option, and then
2. Set the Survey PII purged (e_gdpr_pii_purged) field to indicate the personal data were purged from the record.

Important: To erase more than 2 million files in a 24-hour period, contact your Medallia expert to evaluate possible performance issues.

Note: This topic references the letters "GDPR" in the tools and fields it mentions, but these tools are not limited to applying only to the European Union's General Data Protection Regulation (GDPR). These tools allow companies to employ data management settings to conform to the GDPR. to the California Consumer Protection Act (CCPA), as well as to other laws that regulate the management of personal data and general best practices regarding the collection and protection of personal information.

Erase personal data from records

Erasing personal data from records requires you to prepare the data to erase as well as choose whether to erase the data manually or automatically.

Personal data may be purged or deleted depending on field configuration and the Auto Importer spec used. In this context, purged means the field values are replaced with placeholder values, for example "GDPR purged" for strings. Deleted means the field values are changed to null.

Whether field values are purged or deleted depends on several factors, including

whether the PII field property was enabled using Setup or Admin Suite
the signal type and auto importer configuration used to initiate the GDPR data removal

Additionally, in some cases, when a profile linked to a survey that is subject to a GDPR data removal request has a field with the personally identifiable information property enabled, all fields in that profile are purged or deleted, even if those fields don't have the PII property.

Prepare to erase personal data

Create a feed file that identifies the records to cleanse. For more information, see Feed file format, below.
On the Auto Importer Processors screen, create an import specification using the appropriate plugin and format. For more information, see:
- Erase user data (AccountGdpr)
- Erase respondent survey data (SurveyGdpr)

Erase personal data manually

On the Auto Importer Processors screen, select the import specification and use the Process a file on pretend property to upload the feed file.
On the Feed Files screen, locate the feed file and click Reprocess on Active to run the process to erase the data.
Check the Import Processing Reports to review the results of the purge.

Erase personal data automatically

Create an Importer feed to receive the feed files, and pass the file to the import specification. For more information, see Feeds.
Pass or upload the feed file to the target feed.
Check the Import Processing Reports to review the results of the purge.

Important: This process may take up to 48 hours to completely cleanse all records.

Feed file format

The feed file is in CSV format and contains two comma-separated columns of data.

The first row in the file is a header that assigns names to the columns. For this documentation, the names are field and value.

Note: You can use any names for the column labels; however, the labels must match the names in the import specifications.

The remaining rows are the data that identify the records. For each row:

The first column (field) is the name of an indexed Event field that contains a unique ID which identifies the record to cleanse. Note that an indexed field is one with the Used for Duplicate Checking property turned on.
The second column (value) is the unique value that identifies the account or customer in the field identified in the first column.

For example, the following feed file identifies two user accounts. The first row is a header that names the input column (field and value), and the next two rows identify the accounts by username.

field,value
username,david_smith415
username,karen_thomas036

Similarly, the next example feed file cleanses records: two based on survey ID, and one based on respondent email.

field,value
surveyid,3715993
surveyid,2714595
e_email,greg_northern@example.com

When using text fields, be sure to account for variations where possible, because matching text field values is case-sensitive. For example, including Name@Example.com in the feed does not match name@example.com in the database. Generally, values stored in the Email field are lowercase. To ensure a match, consider adding a JavaScript transform to convert incoming values to lowercase.

Restriction: It is possible that one value identifies more than one survey record. In the example above, all surveys with the named email or phone number will be cleansed. As a safety precaution, for:

Accounts, no more than 100 records may be cleansed per row in the feed file.
Surveys, no more than 25,000 records may be cleansed per row in the feed file.

An import that exceeds one of the above limits will fail, and no data will be erased. Additionally, the Import Processing Reports for that import includes warning that the limit was exceeded.

Erase user data (AccountGdpr)

Restriction: For user accounts, delete the account before erasing the personal data. On the Users screen, select the user, click the details pane menu, and select Delete.

If the company is using Single sign-on (SSO), deactivate the employee with in the identity provider (IdP) before erasing the personal data. Otherwise, the IdP can recreate the user account (if the employee uses SSO to access Medallia Experience Cloud.

For accounts, the values for these fields are changed to null:

Firstname
Lastname
Salutation
Email
Phone
User name
Note: Experience Cloud requires a unique user name. As such, the name is changed to an anonymous value instead of erased. In this case, an employee who is rehired may use their original username because the original name is no longer in Experience Cloud.

Use this import specification:

<import-spec name="User Account GDPR Erase">
    <input-column heading="field" />
    <input-column heading="value" />
    <output-column-group pluginName="AccountGdpr" recordUpdateMode="CREATE">
        <output-column>
            <input-column heading="field" />
            <target-field fieldId="gdpr_field" fieldName="GDPR field" requiredness="REQUIRED" type="STRING" />
        </output-column>
        <output-column>
            <input-column heading="value" />
            <target-field fieldId="gdpr_value" fieldName="GDPR value" requiredness="REQUIRED" type="STRING" />
        </output-column>
    </output-column-group>
</import-spec>

In the specification:

The pluginName is AccountGdpr.
The names of the two input columns are field and value. You may change these if necessary.
The corresponding target-fields are gdpr_field and gdpr_value, respectively. Do not change these.

Erase respondent survey data (SurveyGdpr)

Note: This process also cleans all records, including junked and excluded ones, which are "invisible" to most other operations. No additional work is necessary, and the records remain junked or excluded.

For surveys, the fields to purge are the ones noted by the Personally Identifying Data property:

The Personally Identifying Data property of all field types marks data as personal

In addition to the custom fields defined for the company, these fields are permanently flagged as personal:


Event fields	System fields
First name Last name Email Phone Address Address 2 City State Postal code	IP address HTTP Client cookies Full name Full address Survey taker location at the start of the survey (a_survey_taker_location_longitude) Survey taker location at the start of the survey (`a_survey_taker_location_longitude`) The IP address from which the invitation was opened

Use this import specification:

<import-spec name="Survey GDPR Personal Data Delete">
    <input-column heading="field" />
    <input-column heading="value" />
    <output-column-group pluginName="SurveyGdpr" recordUpdateMode="CREATE">
        <output-column>
            <input-column heading="field" />
            <target-field fieldId="gdpr_field" fieldName="GDPR field" requiredness="REQUIRED" type="STRING" />
        </output-column>
        <output-column>
            <input-column heading="value" />
            <target-field fieldId="gdpr_value" fieldName="GDPR value" requiredness="REQUIRED" type="STRING" />
        </output-column>
    </output-column-group>
</import-spec>

In the specification:

The pluginName is SurveyGdpr
The names of the two input columns are field and value. You may change these if necessary.
The corresponding target-fields are gdpr_field and gdpr_value, respectively. Do not change these.

Erase data from Total Experience Profiles

Erasing data from surveys also erases data from Customer Profiles.

Any profile record with a field that has the Used for contact identity property and matches a purged signal record is erased.

If a link exists, all fields in the profile are erased when data in the feedback record is erased. For more information, see Experience programs migration .

Tip: If any field linking the signal to the Profile is indexed, erasing data from the profile happens much faster than when no linking fields are indexed. For more information, see Profile field settings.