---
title: "Compliance"
description: "Meet your data protection duties: the audit log, subject access requests and erasing a customer's data."
---

> Documentation Index
> Fetch the complete documentation index at: http://localhost:4321/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> **Administrators only**
>
> This part of the portal is only visible to people with the **Administrator** role. If you can't see it in your menu, ask an administrator. See [Roles and permissions](/reference/roles-and-permissions).

You hold personal information about your customers, so you have duties around it. Under **Compliance** in the menu are three tools that cover the common ones.

- **Audit log** — A record of every change made in the portal: what, by whom, when and to which customer. [Read](/compliance/audit-log)
- **Subject access request** — When a customer asks "what do you hold on me?", find them and export everything as a PDF. [Read](/compliance/subject-access-requests)
- **Scrub data** — When a customer asks you to erase their data, anonymise them everywhere. [Read](/compliance/scrub-data)

> **This is a tool, not legal advice**
>
> These screens help you act on a request. How quickly you must respond, what you must keep for your accounts, and what you can refuse depend on where you operate. Check with your own adviser if you're unsure.

## A typical request

1. A customer emails to ask for their data, or to be erased.
2. You confirm it really is them, such as by replying to the email address on their account.
3. For access, use [Subject access request](/compliance/subject-access-requests) and send them the PDF.
4. For erasure, consider doing an access export first, then use [Scrub data](/compliance/scrub-data).
5. Keep your reply with your records.

Source: http://localhost:4321/compliance/index.mdx