Delete User Identity in Saviynt IGA post termination request received from workday HR system..

[nkashyap]

Hello Team,

Please find the details about this request for information:

Subject: Delete User Identity in Saviynt upon termination received from workday HR system along with associated accounts based on specific country criteria.

Details:

Due to data protection policy at client, we have received a use case from client that they are looking to Delete User Identity in Saviynt upon termination received from workday HR system along with associated accounts based on a particular country criteria.

Criteria: Based on particular country

So, can you please confirm that this use case is possible in Saviynt and can be done?

eagerly waiting for the response on this.

Thanks,

Navin

[dgandhi]

It is not possible to delete the user identity completely from Saviynt, to meet compliance requirement, you can erase the PII data from user profile and target.

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter07-General-Administrator/Bes...

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter07-General-Administrator/Era...

[pruthvi_t]

Hi @nkashyap ,

Unfortunately we do not delete identity/accounts related data from saviynt. So this use case may not be achieved through saviynt, instead you can erase the PII data as @dgandhi mentioned.

Thanks,

[rushikeshvartak]

Personally identifiable information (PII) includes information that can be used to distinguish or trace an individual's identity either directly or indirectly through linkages with other information.

You can't delete users/accounts/roles/endpoints etc for audit purpose. You can erase PII information from User object

[surajkrishnaiah]

Saviynt platform has the requisite capabilities that are needed to satisfy EU’s “Right to be Forgotten” GDPR Regulations ( https://gdpr.eu/article-17-right-to-be-forgotten/   ). Enterprises already rely on Saviynt to govern their identities while being in compliance with GDPR requirements. The “Right to be Forgotten” regulations of GDPR require that an organization should delete all the personal information collected on an individual and that any downstream applications and data stores of the organization that contain any personal information should also delete that information. The deletion should happen either when a valid request is received from the individual, or when there is no longer a legal basis for processing such personal data as a result of a deletion deadline according to the organization’s  data retention policies, or at the request of a supervisory authority to comply with a individual’s right to erasure request.

Saviynt’s Right-to-be-Forgotten feature provides the ability to delete all Personally Identifiable Information (PII) of a user either manually upon receiving a request for erasure  or automatically after a particular period of time as per the data retention policy of the organization . (https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter07-General-Administrator/Right-To-Be-Forgotten.htm  ) The customer can also set up automated rules to delete the accounts of the user within target applications and also delete any personal information that is stored related to the accounts using the process outlined in the below document.(https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter07-General-Administrator/Era... ) Upon the erasure of the PII data, a user profile identifier is substituted with a machine generated anonymized identifier and this ensures that the GDPR Right-to-be-forgotten requirements are met while still retaining the ability for auditors to adhere to other compliance mandates. Saviynt’s Right-to-be-Forgotten capabilities also allow for different data retention time period policies to be set up for different users depending on their Country or legal jurisdiction to ensure that the organization is always in compliance with data retention requirements that can vary between different geographic regions.