/
🛡️ Consent based Remediation

🛡️ Consent based Remediation

Consent-Based Remediation is a governance-driven approach where actions such as deletion, quarantine, or redaction of data are executed only after explicit approval by authorized individuals, typically data owners or information custodians.

This model ensures:

  • ✅ Accountability: The person responsible for the data (not IT alone) makes the decision.

  • ✅ Transparency: All actions are traceable with audit trails showing who consented and when.

  • ✅ Governance Compliance: Aligns with regulations like GDPR, KVKK, and ISO 27001 by enforcing a human decision before irreversible actions.

  • ✅ Automation with Control: Once a user’s note approves, GEODI automates execution in scheduled workflows—removing manual errors or delays.

🔍 Best For:

  • Regulated industries (finance, healthcare, government)

  • Environments with strict data stewardship policies

  • Organizations promoting shared responsibility in the data lifecycle

💡 How we do it?

  1. You need to install the "Consent-Based Data Remediation" module from DECE-STORE. This module includes ready-to-use workflows and the necessary definitions for marking the data. The process is entirely automatic and driven by user consent.

  2. You can send an email like the one below to data owners or users involved in the process.

  3. The data owner first locates the document or content through the GEODI search and then annotates it using one of the options below.

    1. Approve:BackupAndDelete → The data will be deleted after safely being copied to a secure location.

    2. Approve:BackupAndMAsk → After being securely copied, the content will be masked. All findings within the file will be masked.

    3. Approve:Delete → The content will be permanently deleted without being copied.

    4. Approve:ReportAsFP → If you believe a finding is a false positive, you can report it and provide a brief explanation.

 

  1. Scheduled workflows review these tags periodically and execute the action (delete/quarantine).

  2. A report is sent to managers, summarizing what was done and which documents were marked by users.

    1. The report is sent to all users who are included in the ACC Discovery group and have an email address defined.

  3. Audit logs retain the owner’s decision, even after removing the content.

 

Subject: 🛡️ Review and Action Options for Your Sensitive Data

...

As part of our commitment to data security and privacy, the GEODI DSPM platform now allows you to mark the data you wish to delete, quarantine, or mask.

Before taking any action on these data, we would like to obtain your consent. Based on your approval, the data will be automatically processed. Similarly, you can mark any findings you believe to be incorrect (False Positives).

To proceed, please open GEODI via the following address: <geodiurl> and provide your consent by annotating the relevant data. Instructions on how to perform this action can be found at the following link:

🛡️ Consent based Remediation | 💡 How we do it?

 

Thank you for your attention to data security.

...

Data Protection Team