Data protection

In short

A monitoring system holds a great deal of personal data: who your customers are, where their money goes, and which of them are under suspicion. Data protection laws (Ghana’s Act 843, Nigeria’s NDPA, Kenya’s DPA, the GDPR and others) give those customers rights over that data, and give your institution duties: keep it no longer than necessary, answer people’s requests on time, keep registers, and report breaches.

The Privacy area in SpeculaPro is where your data protection officer (DPO) meets those duties for the data SpeculaPro holds. It has four pages:

Page	What it does	Guide
Retention & legal holds	How long each kind of data is kept, the legal minimums that can’t be undercut, the automatic purge, and legal holds that keep data whatever its age	Retention and legal holds
Requests	Data subject requests (access, rectification, erasure, restriction, objection, portability), each with its legal deadline and the tipping-off safeguard	Data subject requests
Registers	Your data protection settings, the record of processing, lawful bases and cross-border transfers	Registers
Breaches	Personal data breaches, the notifications each law requires with their deadlines, a response checklist and an export for the regulator	Breach register

Select Privacy in the left-hand menu. It opens the first page your role can see.

This is not legal advice; confirm with counsel

SpeculaPro builds in deadlines and minimums from the laws listed in Laws by country. They were checked against the primary texts in October 2026 unless marked otherwise, but your institution remains responsible for its own compliance. Confirm every period and deadline with your legal adviser, and note the open legal points.

Two rules that override everything else

Data protection and anti-money laundering pull in different directions. SpeculaPro settles the conflict with two rules, applied everywhere in the Privacy area:

1. AML record keeping beats erasure while records are inside their retention period. AML laws require you to keep identity and transaction records for years (five in Ghana, Nigeria, South Africa, the EU and the UK; seven in Kenya; ten in the UEMOA countries), and every data protection law has an exemption for a legal obligation to keep data. So when a customer asks to be erased, SpeculaPro doesn’t delete records it must keep: it records the decision, the legal basis and the date erasure becomes possible, and erases them on that date.
2. No tipping-off. Telling a customer, directly or by implication, that they are under investigation or have been reported to the FIU is a criminal offence. A request from a customer under an open case or the subject of a suspicious transaction report goes to the MLRO first, and monitoring data (alerts, cases, reports, decisions, risk ratings, designations) is never part of any export, for anyone.

Who uses it: roles and permissions

Three permissions control the Privacy area:

Permission	What it allows
privacy.view	Read everything in the Privacy area: retention, dry runs and purges, legal holds, requests, registers and breaches
dsr.handle	Register and work data subject requests. Exporting a person’s data also needs entities.view_pii, because the export decrypts it
privacy.manage	The DPO’s tools: retention periods and the purge, legal holds, the registers and settings, and the breach register

The built-in roles hold them like this:

Role	privacy.view	dsr.handle	privacy.manage	Also relevant
Data protection officer (new)	✓	✓	✓	entities.view and entities.view_pii (to find customers and export their data), audit.view, settings.view
MLRO / Compliance officer	✓			reports.approve: reviews requests flagged by the tipping-off safeguard
Auditor (read-only)	✓

The Data protection officer role is added to every workspace by migration 00030_privacy. It sees no alerts, cases or rules: its job is the institution’s data protection duties, not investigations. Give it to your DPO, and to a deputy if retention changes and legal holds must be approved by a second person (see below).

Requests flagged for the MLRO

The MLRO reviews flagged requests because they hold reports.approve, the permission that already makes them responsible for suspicious transaction reports. They can see the request (through privacy.view) but don’t handle requests themselves.

Changes that need a second person

Two kinds of change in the Privacy area can be put under maker-checker:

Kind of change	What it covers	Approval by default
Retention and purging	Changing a retention period or what happens at its end, switching the purge on or off, and changing the workspace’s data protection jurisdictions (which change the minimums)	On
Legal holds	Placing or releasing a legal hold	On

Both are proposed and approved by people with privacy.manage; the person who proposes can’t approve their own request. As for every kind of change, a default only takes effect once two people can approve it. With a single DPO, retention changes and holds apply straight away; give the role to a deputy to put them under dual control. See Defaults start once two people can approve.

What happens in the background

The worker does four data protection jobs, after its regular housekeeping (every SP_WORKER_INTERVAL, six hours by default):

• The purge, for workspaces that switched it on: a new run starts once the last one is 20 hours old, so about once a day (every 20 to 26 hours), and a large backlog is worked through over several runs. See How the purge works.
• Scheduled erasures: erasure requests postponed by AML record keeping are carried out once their date passes and nothing holds the records.
• The MLRO check on open requests: every open data subject request is checked again, and flagged for the MLRO if a case or report now concerns the person. See The tipping-off safeguard.
• Reminders: requests due within three days and breach notifications due within 24 hours.

Where the optional analytics store is installed, the worker also removes from its copy whatever the purge or an erasure removed, usually within a minute or two.

Where to start

1. Check the settings. Open Privacy → Registers → Settings and confirm the main jurisdiction, any other laws that apply (for example the GDPR if you serve people in the EU), the hosting country, the DPO and your registration with the data protection authority. See Registers.
2. Review the pre-filled registers. SpeculaPro fills in the record of processing, lawful bases and transfers with what it does on your behalf. Edit them to match your institution.
3. Review retention. Look at each category’s period and minimum. Run a dry run to see what a purge would remove, then decide whether to switch the purge on. See Retention and legal holds.
4. Agree who handles requests, and make sure the MLRO knows they will be asked to review flagged ones.
5. Rehearse a breach. Read the breach register page so the first real breach isn’t the first time anyone opens it.

Related

• Retention and legal holds
• Data subject requests
• Registers
• Breach register
• Laws by country
• Known limits
• Privacy API
• Data protection (security model)