Consent Docs
Open console

People events

The webhook events sent when a person is erased, is about to be erased for inactivity, or makes or confirms a rights request, with payloads.

Reference6 min readFor developers calling the REST API

Seven webhook events are about a person as a whole: three on erasure and four on rights requests. Each arrives in the envelope described in Webhook format.

Erasure events#

subject.erased#

Sent when

A record is erased on request: with POST /subjects/erase, from the console, or by an erasure request your team carried out. One event is sent for each record. Delete your own copy of the person's data when it arrives.

Payload

Field in data Type Description
consentId string The record that was erased.
subject.type string The type of identifier the record was recorded under.
subject.fingerprint string or null The subject fingerprint, taken immediately before the erasure, so it still matches your user.
subject.reference string or null The identifier as you sent it, only when your project stores a readable copy.
erasedOn time When the record was erased.
reason string or null The reason given with the erasure. null when the console gave none.
actingAs object Present only when a parent, lawful guardian or nominee asked for the erasure. See Who acted for the person.
test boolean true for a record written with a test key.
processors array An ERASE for each Data Processor the person ever allowed on this record. See Processor instructions.

Example

JSON
{
  "id": "0c7e5b3a-9f21-4d68-a4b0-6e1d8c2f7a55",
  "type": "subject.erased",
  "createdOn": "2026-09-24T10:12:03.498Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "consentId": "cns_3f1c9a7e2b8d4c6fa0e5d1b7c9f2a4e8",
    "subject": {
      "type": "USER_ID",
      "fingerprint": "8c41…",
      "reference": null
    },
    "erasedOn": "2026-09-24T10:12:03.000Z",
    "reason": "Erasure requested by the learner",
    "test": false,
    "processors": [
      {
        "taskId": "7e3b0d52-9a14-4c6f-b8e2-1d5a9c3f7b60",
        "key": "nilgiri-mailers",
        "name": "Nilgiri Mailers",
        "action": "ERASE",
        "purposes": ["course-updates-by-email"],
        "dueOn": "2026-10-24T10:12:03.498Z",
        "retainLogsUntil": "2027-09-24T10:12:03.000Z"
      }
    ]
  }
}

subject.erasure_notice#

Sent when

A person is 72 hours from being erased for inactivity. This happens only when your team has turned on Erase after inactivity. One notice is sent for each person, not for each record. Tell the person now: under DPDP Rule 8(2) they must hear at least 48 hours before the erasure.

Payload

Field in data Type Description
consentId string The person's most recent record.
subjectReference string or null The identifier as you sent it, only when your project stores a readable copy.
lastActivityOn time The last contact with the person.
erasureOn time When the erasure happens. It is never less than 48 hours after the notice.

This event carries no fingerprint. Match it by consentId or by the reference.

Example

JSON
{
  "id": "6b2f9d40-1a7c-4e83-b5d9-0c3a8e7f1b24",
  "type": "subject.erasure_notice",
  "createdOn": "2026-12-24T07:00:00.220Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "consentId": "cns_3f1c9a7e2b8d4c6fa0e5d1b7c9f2a4e8",
    "subjectReference": null,
    "lastActivityOn": "2025-12-27T06:30:00.000Z",
    "erasureOn": "2026-12-27T06:30:00.000Z"
  }
}

Nobody is erased unless someone is listening

If no enabled endpoint subscribes to subject.erasure_notice, the service cannot warn you, so it erases nobody for inactivity.

To cancel a notice, report the person's activity with POST /activity.

subject.erased_inactive#

Sent when

A person was erased for inactivity. No consent.withdrawn or subject.erased event is sent for these records; this event stands for both. Erase the person's data in your own systems too, apart from what a law requires you to keep.

Payload

Field in data Type Description
consentId string The person's most recent record.
subjectReference string or null The identifier as you sent it, only when your project stores a readable copy.
lastActivityOn time The last contact with the person.
processors array An ERASE for each Data Processor, across the person's records. Empty when the person was known only by a cookie or session id. See Processor instructions.

This event carries no fingerprint.

Example

JSON
{
  "id": "a94d1e6c-3b58-4f72-8e0a-5d7c2b9f4e13",
  "type": "subject.erased_inactive",
  "createdOn": "2026-12-27T07:00:02.640Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "consentId": "cns_3f1c9a7e2b8d4c6fa0e5d1b7c9f2a4e8",
    "subjectReference": null,
    "lastActivityOn": "2025-12-27T06:30:00.000Z"
  }
}

Rights request events#

subject_request.received#

Sent when

Someone submits the hosted rights request form. Requests your team types into the console send no event. Email verificationUrl to replyTo: the request waits until the person follows the link.

Payload

Field in data Type Description
reference string The request's reference, shown to the person and in the console.
requestType string ACCESS, PORTABILITY, ERASURE, WITHDRAW_CONSENT, NOMINATION, GRIEVANCE, OBJECTION, RECTIFICATION or RESTRICTION.
subjectId string What the person typed to identify themselves, in readable form.
actingAs string Who made the request: SELF, PARENT, LAWFUL_GUARDIAN or NOMINEE.
replyTo string or null Where to write back: the contact given, or else the email address of whoever made the request.
dueOn time The deadline for answering.
verificationUrl string The link the person must follow to confirm the request is theirs.
statusUrl string The request's status page, where the person reads your reply. Valid for 180 days. Send it with the confirmation link.
contact object Whom to contact. See The contact object. Put it in your reply.

Example

JSON
{
  "id": "d5a07f3e-8c14-4b69-9a2e-4f6b1c8d0e72",
  "type": "subject_request.received",
  "createdOn": "2026-09-24T10:12:03.377Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "reference": "DSR-2026-4F2A91",
    "requestType": "ACCESS",
    "subjectId": "kavya.menon@example.in",
    "actingAs": "SELF",
    "replyTo": "kavya.menon@example.in",
    "dueOn": "2026-10-24T10:12:03.000Z",
    "verificationUrl":
      "https://console.dpconsent.com/consent/sdk/v1/pages/verify-request?token=…",
    "statusUrl":
      "https://console.dpconsent.com/consent/sdk/v1/pages/request-status?token=…",
    "contact": {
      "organisation": "Kalpa Learning",
      "email": "grievance@kalpalearning.example.in",
      "dataProtectionOfficer": "Meera Iyer"
    }
  }
}

If you keep records under your own id, link the request to it with POST /requests/link.

subject_request.due_soon#

Sent when

An open request is due within five days or is overdue. The event is sent once a day for each such request until the request is closed.

Payload

Field in data Type Description
reference string The request's reference.
requestType string The type of request, as in subject_request.received.
status string RECEIVED, VERIFYING or IN_PROGRESS.
dueOn time The deadline for answering.
daysRemaining integer Days until the deadline. Negative once the request is overdue. A part day counts as a whole one.
overdue boolean true as soon as the deadline has passed.
contact object See The contact object.

Example

JSON
{
  "id": "38f6c2b1-7e9a-4d05-b3c8-9a1e5d4f6072",
  "type": "subject_request.due_soon",
  "createdOn": "2026-10-21T02:30:00.412Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "reference": "DSR-2026-4F2A91",
    "requestType": "ACCESS",
    "status": "IN_PROGRESS",
    "dueOn": "2026-10-24T10:12:03.000Z",
    "daysRemaining": 4,
    "overdue": false,
    "contact": {
      "organisation": "Kalpa Learning",
      "email": "grievance@kalpalearning.example.in",
      "dataProtectionOfficer": "Meera Iyer"
    }
  }
}

subject_request.completed#

Sent when

A request is carried out, or closed as completed or rejected in the console.

Payload

Field in data Type Description
reference string The request's reference.
requestType string The type of request, as in subject_request.received.
subjectHash string The hash of the identifier the request is about.
outcome string COMPLETED or REJECTED.
completedOn time When the request was closed.
actingAs string Who made the request: SELF, PARENT, LAWFUL_GUARDIAN or NOMINEE.
reply string or null The answer your team wrote when closing the request. Email it to the person.
statusUrl string The request's status page, which shows the reply. Valid for 180 days.
correction object Only for a closed correction request: summary, what was corrected, and evidenceSha256, or null.
contact object See The contact object.

Example

JSON
{
  "id": "7e1b4a9d-2f6c-4835-a0d7-c3e9f5b28164",
  "type": "subject_request.completed",
  "createdOn": "2026-10-02T09:00:00.156Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "reference": "DSR-2026-4F2A91",
    "requestType": "ACCESS",
    "subjectHash": "b7c1…",
    "outcome": "COMPLETED",
    "completedOn": "2026-10-02T09:00:00.000Z",
    "actingAs": "SELF",
    "reply": "Your data export is attached to this email.",
    "statusUrl":
      "https://console.dpconsent.com/consent/sdk/v1/pages/request-status?token=…",
    "contact": {
      "organisation": "Kalpa Learning",
      "email": "privacy@kalpalearning.example.in",
      "dataProtectionOfficer": "Meera Iyer",
      "phone": "+91 80 4567 8900",
      "postalAddress": "14 MG Road, Bengaluru 560001",
      "grievanceOfficer": {
        "name": "Arvind Rao",
        "email": "grievance@kalpalearning.example.in",
        "phone": "1800 425 0101"
      }
    }
  }
}

subject.rectification_requested#

Sent when

A person asks to have their data corrected, completed or updated. A request from the hosted form sends it once the person confirms it. A request your team logs sends it at once. Correct the data in your own systems, then close the request with what was corrected.

Payload

Field in data Type Description
reference string The request's reference. Match it to subject_request.received.
requestType string RECTIFICATION.
note string or null What the person wrote, in their words.
actingAs string SELF, PARENT, LAWFUL_GUARDIAN or NOMINEE.
dueOn time The deadline for answering.
contact object See The contact object.

The event carries no identifier and no hash of one.

Example

JSON
{
  "id": "5c0e8f2a-6b37-4d91-a2c4-7e9b1d3f5a08",
  "type": "subject.rectification_requested",
  "createdOn": "2026-10-09T11:20:41.902Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "reference": "DSR-2026-8C31D0",
    "requestType": "RECTIFICATION",
    "note": "My delivery address changed to 22 Park Street, Kolkata",
    "actingAs": "SELF",
    "dueOn": "2026-11-08T11:18:02.000Z",
    "contact": {
      "organisation": "Kaveri Stores",
      "email": "privacy@kaveristores.example.in",
      "dataProtectionOfficer": "Meera Iyer",
      "phone": null,
      "postalAddress": null,
      "grievanceOfficer": null
    }
  }
}

Shared fields#

The contact object#

Every rights request event carries contact, from Project settings. Name these details in each answer to the person (DPDP Rule 9).

Field Type Description
organisation string or null The project display name.
email string or null The privacy contact.
dataProtectionOfficer string or null The Data Protection Officer, or whoever answers for you.
phone string or null The privacy contact phone.
postalAddress string or null The postal address.
grievanceOfficer object or null name, email and phone of the grievance officer, when one is named.

Who acted for the person#

actingAs on subject.erased and consent.withdrawn is present only when a parent, lawful guardian or nominee made the request behind the change. It is sealed into the record's history with the event.

Field Type Description
role string PARENT, LAWFUL_GUARDIAN or NOMINEE.
requestReference string The request that asked for the change.
authorityConfirmedOn time When your team confirmed their authority.
evidenceSha256 string The SHA-256 of the document your team checked.

↑↓ to move, Enter to open