# The personal data manual

<!-- module: s17-privacy · deck: What people ask about the data held on them: a copy, a correction, to be erased, to stop a use; each request due within 30 days and every step recorded; a copy sent as a link that asks for a code; an erasure that shows what happens first; consents only the person gives. -->

**Table of contents · 25 October 2026 · S17 of plan CORE. What Ghana's Data Protection Act 2012 (and the GDPR, for
anyone it reaches) asks of every app.**

People may ask what a workspace holds on them, have it corrected, have it erased, or stop a use of it. Each request is
**due within 30 days** of receipt, and every step is recorded. A **copy** holds only this workspace's data, as data and to
read, and goes as a link that sends a code to the same address first. An **erasure** shows what happens to each kind of
data before anyone presses the button. A person's **consents** are theirs alone to give.

The one sentence to carry through it: **erasing someone leaves no name, contact or ID readable anywhere**: the logs keep
that things happened, and name them only by a code.

**Who meets what**

| Seat | Who | What they do here |
|---|---|---|
| Owner | Anyone whose role holds *Answer personal-data requests* (the Owner as shipped) | Logs requests; prepares and sends a copy; answers, refuses or erases; records a withdrawn consent |
| Anyone signed in | Every person in the workspace | My data: their consents, ask for a copy, a correction or to be erased |
| The person, with a link | Whoever asked for a copy, signed in or not | Opens their copy with a code sent to them |

**As shipped**

| | Shipped |
|---|---|
| A request is due within | 30 days of receipt (a workspace may answer sooner: 1 to 30) |
| A copy's link works for | 7 days |
| A code works for | 10 minutes; 5 asked for or tried a minute |
| Consent purposes | Marketing e-mails, Photos in the newsletter (Input Fields › Consent purposes) |
| How a request came | In the app, E-mail, Letter, In person (Input Fields) |

---

## Part 1 · Requests, copies, erasure, consents

- [1.1 Logging a request](p01-privacy.md#11-logging-a-request)
- [1.2 Sending someone a copy of their data](p01-privacy.md#12-sending-someone-a-copy-of-their-data)
- [1.3 Deciding an erasure](p01-privacy.md#13-deciding-an-erasure)
- [1.4 Answering a correction, or refusing](p01-privacy.md#14-answering-a-correction-or-refusing)
- [1.5 Recording a withdrawn consent](p01-privacy.md#15-recording-a-withdrawn-consent)
- [1.6 My data](p01-privacy.md#16-my-data)