Request for removing personal/sensitive data

An individual may request to remove personal data (from the Visma system if it contains such information). These requests need to be verified by the Controller against existing accounting laws in the various countries (accounting regulations usually require the storage of accounting documents and invoice documents for many years). Accounting laws override the GDPR.

If the individual is entitled to have their personal data removed from the Visma system because the data/documents aren't covered by accounting regulations any more, then the Controller needs to follow this request.

Business NXT has a set of layouts for searching records that contain personal information, if the system has been used as intended by the Controller. If personal data is stored in free text fields or new fields, the Controller will need to modify these layouts accordingly.

Contacts, customers, suppliers, employee records, user records, order documents and customer documents contain personal data. Memos can also contain personal or even sensitive information. That needs to be verified when a request for removing data is in process. In order to keep the database integrity, it won't be possible to delete all entities (for example if accounting transactions are connected to a customer). In cases where a deletion isn't possible, the data must be anonymised by the Controller (by updating all fields where personal data is stored). In Business NXT it's possible to delete order documents and customer documents. Customers or suppliers requesting to delete their data needs to be handled with care because these entities may have transactions associated with them; the following steps need to be considered:
  • Are there transactions which need to be kept according to national bookkeeping rules? If this is the case, then the Controller can't remove or anonymise data because the customer/supplier information is still subject to regulations overriding the right to be forgotten according to GDPR.
  • If there are no transactions at all on the customer/supplier, then the records can be deleted,
  • If there are only old transactions (not covered by the bookkeeping regulations), then the following should be done:
    • Create an anonymised customer/supplier which will be used to store old transactions (if it doesn't already exist).
    • Add the anonymisation numbers in the Customer no. for anonymisation and Supplier no. for anonymisation fields respectively in the Company information table.
    • Run the Delete customer/supplier data processing in the Associate table using the customer/supplier number for storing old transactions. This will change all accounting records and product transactions to the new customer/supplier number, all references to the old customer/supplier number will be gone, and additionally, the following will be deleted:
      • Appointments
      • Orders (including order attachments)
      • Order documents
      • Customer documents
      • The contacts for the deleted customer/supplier