> For the complete documentation index, see [llms.txt](https://docs.mediarithmics.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mediarithmics.io/setup-and-monitor/ensure-privacy-and-compliance/exercise-rights-of-the-user.md).

# Exercise rights of the user

Answer an access request and an erasure request, manually or from your own systems.

## Your goal

Answer a request from an individual - "what do you hold about me?" and "delete it" - reliably enough to say so on the record.

## Expected outcome

A repeatable procedure per request type, usable manually for a one-off and automatable from your centralised systems.

## The two rights the platform implements

Users have the right to **access** their data and to **erase** it. The platform provides methods for both, and all of these operations can be performed manually or automated through the API from your centralised systems.

{% hint style="info" %}
Consent and objection are handled separately, as a standing state rather than a one-off request. See [Manage consent & Processing activities](/setup-and-monitor/ensure-privacy-and-compliance/manage-consent-and-processing-activities.md).
{% endhint %}

## Retrieve all data related to a user

Two routes:

{% columns %}
{% column %}

### In the interface

Look the user up in the Navigator and read what is attached to their UserPoint.

See [Explore a user profile](/setup-and-monitor/operate-and-monitor/explore-a-user-profile.md).
{% endcolumn %}

{% column %}

### By API

Use the UserPoint APIs, selecting the user by any identifier.

See [Server-side events](/setup-and-monitor/collect-and-manage-your-data/collect-data-in-real-time/server-side-events.md#the-userpoint-selector) for the selector syntax.
{% endcolumn %}
{% endcolumns %}

{% hint style="warning" %}
Retrieve **before** you delete. Deletion removes the UserPoint and everything attached to it, so an access request answered after an erasure cannot be answered at all.
{% endhint %}

## Delete all data related to a user

Deleting a UserPoint removes it and all related documents - user identifiers, activities, profiles, and the rest. Select the UserPoint by whichever identifier the request gives you:

| You have                      | Endpoint                                                                                                    |
| ----------------------------- | ----------------------------------------------------------------------------------------------------------- |
| A UserPoint ID                | `DELETE /v1/datamarts/:datamartId/user_points/:userPointId`                                                 |
| An email hash                 | `DELETE /v1/datamarts/:datamartId/user_points/email_hash=:emailHash`                                        |
| An account ID and compartment | `DELETE /v1/datamarts/:datamartId/user_points/compartment_id=:compartmentId,user_account_id=:userAccountId` |
| A user agent ID               | `DELETE /v1/datamarts/:datamartId/user_points/user_agent_id=:userAgentId`                                   |

All on `https://api.mediarithmics.com`.

UserPoints can also be deleted **in bulk** through a document import, which is the route for a batch of suppression requests. See [Delete user data](/setup-and-monitor/collect-and-manage-your-data/clean-and-delete-data/delete-user-data.md).

## Handling a request end to end

{% stepper %}
{% step %}

### Identify the person in the datamart

A request arrives with an email address, an account number, or a device identifier. Hash the email with **your datamart's hash function** - a hash produced differently will not match. See [User Email](/setup-and-monitor/collect-and-manage-your-data/design-your-data-model-and-schema/user-identity/user-identifiers/user-email.md).
{% endstep %}

{% step %}

### Check whether one UserPoint or several match

Identity resolution means one person is normally one UserPoint - but if your identity model has not consolidated them, an erasure that targets one identifier leaves the rest. Look the person up by **each** identifier they gave you.

See [Resolve identities](/setup-and-monitor/collect-and-manage-your-data/design-your-data-model-and-schema/user-identity/resolve-identities.md).
{% endstep %}

{% step %}

### Retrieve, if the request is an access request

Export what you found before doing anything else.
{% endstep %}

{% step %}

### Act

* **Access** - return the retrieved data.
* **Erasure** - delete the UserPoint or UserPoints.
* **Withdrawal of consent** - record the choice rather than deleting, with the `Exercise of rights` choice source if you use source weights, so a later CMP value does not silently overwrite it. See [choice sources](/setup-and-monitor/ensure-privacy-and-compliance/manage-consent-and-processing-activities.md#when-several-sources-set-the-same-choice).
* **Removing one identifier only** - use an identifier deletion, which leaves the UserPoint in place. See [Import identifiers](/setup-and-monitor/collect-and-manage-your-data/import-data-in-batch/import-identifiers.md).
  {% endstep %}

{% step %}

### Propagate to your copies

The platform deletes its own data. It does not reach into an export you produced earlier, a file you delivered to a partner, or a warehouse you loaded.

If you run a [datamart replication](/setup-and-monitor/collect-and-manage-your-data/export-your-data/datamart-replication.md), the `DELETE` operations are replicated - so your cloud can act on them, provided your consumer handles them.
{% endstep %}

{% step %}

### Record what you did

Keep the identifiers used, the operations run, and their results. For consent, the platform stores choices **and their change history**, which is the audit evidence - see [Manage consent & Processing activities](/setup-and-monitor/ensure-privacy-and-compliance/manage-consent-and-processing-activities.md#user-choices).
{% endstep %}
{% endstepper %}

## Verify

* Looking the person up by **every** identifier they provided returns nothing after an erasure.
* A device point deletion left the UserPoint intact, if that was the intent.
* Downstream systems that hold a copy have been notified or updated.
* The request, the operations, and the outcome are recorded.

## Related pages

<table data-view="cards" data-search="false"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Delete user data</strong></td><td>The deletion operations in detail, including bulk.</td><td><a href="/setup-and-monitor/collect-and-manage-your-data/clean-and-delete-data/delete-user-data.md">Delete user data</a></td></tr><tr><td><strong>Explore a user profile</strong></td><td>Retrieving what the platform holds about one person.</td><td><a href="/setup-and-monitor/operate-and-monitor/explore-a-user-profile.md">Explore a user profile</a></td></tr><tr><td><strong>Manage consent &#x26; Processing activities</strong></td><td>Consent, objection, and the change history.</td><td><a href="/setup-and-monitor/ensure-privacy-and-compliance/manage-consent-and-processing-activities.md">Manage consent &amp; Processing activities</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.mediarithmics.io/setup-and-monitor/ensure-privacy-and-compliance/exercise-rights-of-the-user.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.