Deleting personal data of BPM users

Edit online
To comply with the General Data Protection Regulation (GDPR) requirement that EU data subjects have a right to be forgotten, users that are assigned to the action policy role ACTION_DELETE_USER_PERSONAL_DATA can use REST API calls to delete personal data that is associated with a specific BPM user. By default, BPM administrators are assigned to this role. For information about how to modify the action policies that are contained in the BPMActionPolicy configuration object, see Configuration properties for Process Portal action policies.
Tip: Before a user's personal data can be deleted, their account must be deactivated by removing them from the user registry and then synchronizing the internal user data with the external user registry. The user synchronization can either be preformed by running the BPMSyncExistingUsersTask command with the parameter -userState, or using a REST API, as described in Synchronizing internal and external user data. For more information about user deactivation, see Runtime user availability and lifecycle.
Calling the BPM operations REST API DELETE https://host:port/ops/std/bpm/users/user_id/personal_data makes the following BPM database updates to the information about the deactivated user ID user_id:
  • Replaces the full name of the user with the string "deleted".
  • Deletes information about which user groups the user was a member of.
  • Deletes the user attributes, including the email address that the user provided.
  • Deletes the image that the user used as an avatar.
  • Deletes all task measurement statistics about tasks that the user performed.
  • Deletes login information about the user.

For more information about the personal data operations API, see IBM Business Automation Workflow REST APIs programming.

Important: The delete personal data API must be called with an HTTP header that contains a valid BPMCSRFToken. For more information, see Preventing cross site request forgery.