How to Manage Requests from Authorities under the GDPR

The General Data Protection Regulation (GDPR) establishes the rules regarding the collection, processing, and transfer of personal data within the European Economic Area.

In certain cases, the competent authorities may request information about users, systems, or services hosted in Plenit.

This tutorial explains how Plenit handles these requests, what the role of each party is (Plenit and the partner), and what responsibilities you need to know to ensure compliance.

---

1. Introduction

In this tutorial you will learn to:

• Identify the role of Plenit and the partner within the GDPR framework.
• Understand how requests from the competent authorities are handled.
• Learn about the principles of transparency and security applied.
• Know what steps to follow when a request affects your clients.

Objective: provide operational and legal clarity on data processing within the GDPR framework and avoid errors or misunderstandings in communications with the authorities.

2. Roles in the GDPR

3. Types of authority requests

The competent authorities (e.g., data protection authorities, law enforcement agencies, health authorities) may request:

• User identification (e.g., ownership of an IP address).
• Technical information about hosted servers or systems.
• Contact details of HDS service clients, when required by the French health authority.

Note: all requests must be submitted by formal request in accordance with current legislation.

4. How Plenit handles these requests

5. Special cases

HDS clients (France) French regulations may require the communication of contact details to the health authority, in particular the designated contact during the organization’s registration under the HDS service. Plenit will inform the partner in advance, unless the law expressly prohibits such notification.

Requests from foreign authorities They will only be handled if they are covered by European regulations or valid international treaties. Any request outside that framework will be formally rejected.

6. Principles of transparency and security

Plenit applies the fundamental principles of the GDPR in all processes:

• DPO intervention (Data Protection Officer): all requests are reviewed and validated by them.
• Data minimization: only the necessary information is provided.
• Traceability and recordkeeping: the entire process is documented, from receipt to final response.
• Confidentiality: exchanges are carried out securely and encrypted, in accordance with the principles of privacy by design.

7. What you should do as a partner

Your cooperation is essential to ensure compliance.

• Keep your clients’ information up to date on the Plenit platform.
• Designate a valid point of contact for privacy or compliance communications.
• Coordinate with the Plenit team if a request affects your clients or services.
• Inform your end clients when required by law.
• Keep an internal record of the requests and responses handled.

Tip: if you manage clients with HDS services, also consult the tutorial How to register a client for the HDS service to learn about the specific obligations in France.

8. Limitation of liability

Plenit always acts in accordance with current legislation and the provisions of the GDPR.

However:

• The final responsibility for client data lies with the partner when acting as Data Controller.
• Plenit shall not be liable for penalties or claims arising from improper use of data by the partner or third parties.
• In case of doubt, the partner should consult its legal advisers or its DPO before responding to any authority.

9. Contact

For any inquiries related to the handling of requests under the GDPR: 📧 *[[e-mail]]*

🛈 Note: this channel is intended exclusively for compliance and privacy matters.

10. Conclusion

Proper handling of requests under the GDPR requires coordination, transparency, and traceability. Knowing your role as a partner will allow you to act with legal certainty and maintain your clients’ compliance. For its part, Plenit ensures that all processes respect the principles of lawfulness, minimization, and proactive accountability established by the European Regulation.