Access and roles
Who can open a project in the console, the six project roles, what each may do, and how second-person approval works.
Access to the console is given per project. A person who can open a project gets one role in it, and the server checks that role on every action. Until an owner turns roles on, everyone who can open the project can do everything in it.
How sign-in works#
People sign in through the PIEDAP platform and open the console from its menu. The platform handles sign-in and passwords. The console takes your organisation, account and project from the signed-in session, never from the request.
The six roles#
| Role | For | Can | Cannot |
|---|---|---|---|
| Owner | Whoever answers for the project | Everything, including who has access, keys and settings | — |
| Privacy officer | The Data Protection Officer | Purposes, regions, publishing, rights requests, erasure, breaches, processors, campaigns, legal holds, the Significant Data Fiduciary registers | Manage people, create or reveal keys |
| Grievance officer | Whoever answers people | Find records, handle rights requests and grievances, record nominations, withdraw consent | Erase people, export records, change forms |
| Content editor | Marketing and content | Notice wording, languages, translations, the banner's look; ask for publication | Publish, see records |
| Developer | Engineers | Keys and scopes, webhooks, installation, site scans | Erase people, export records, publish |
| Auditor | An internal or independent data auditor | Read everything; download evidence, the audit log and records | Change anything |
People and roles shows the full grid. A role cannot be widened for one person: give them a different role instead.
Turn roles on#
- Open Settings and choose People and roles.
- Choose Turn on roles. You become the first owner.
- Under Add person, type each person's email address, choose a role and choose Add person.
A person gets their role the first time they open the project with that email address. Until then the list shows Not signed in yet.
Anyone without a role loses access
Once roles are on, a person with no role cannot open the project. The page lists People who have used this project without a role so you can add them before they notice.
A project always keeps at least one active owner. The last owner cannot be removed or given another role.
Second-person approval#
Some actions can wait until someone else in the project approves them. Choose them under Second person approval on People and roles:
- Erase a person's identifiers
- Export a property with its consent records
- Reveal a key
- Reveal the subject fingerprint key
- Download the audit log
When one of these is chosen, running the action sends it for approval instead. Someone with the Owner or Privacy officer role approves or declines it on Approvals. Waiting approvals show at the top right of the console. The person who asked then runs the action again within a day. An approval covers one person, one action and one target, and is used once.
The identifier of a person to erase is never stored with the request. It is kept as a hash, so you type the identifier again when you run the erasure.
Publishing a form has its own switch, Require a second person to publish forms, in Settings. A content editor's publication always waits for someone who may publish.
What the product records#
Every change and every read of personal data is written to the audit log, with who did it, when and from where. That includes role changes, approvals and the actions they cleared. See Read the audit log.