> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/platform/security/how-to-handle-gdpr-authority-requests.md). # How to Manage Requests from Authorities Under the GDPR The General Data Protection Regulation (GDPR) establishes the rules regarding the collection, processing, and transfer of personal data within the European Economic Area. In certain cases, the competent authorities may request information about users, systems, or services hosted in Plenit. This tutorial explains how Plenit handles these requests, what the role of each party is (Plenit and the partner), and what responsibilities you need to know to ensure compliance. *** ### 1. Introduction In this tutorial you will learn to: * Identify the role of Plenit and the partner within the GDPR framework. * Understand how requests from the competent authorities are handled. * Learn about the principles of transparency and security applied. * Know what steps to follow when a request affects your clients. **Objective:** provide operational and legal clarity on data processing within the GDPR framework and avoid errors or misunderstandings in communications with the authorities. ### 2. Roles in the GDPR ![](https://jotelulu.com/wp-content/uploads/2025/11/Frame-04-e1763484401482.jpg) ### 3. Types of authority requests The competent authorities (e.g., data protection authorities, law enforcement agencies, health authorities) may request: * User identification (e.g., ownership of an IP address). * Technical information about hosted servers or systems. * Contact details of HDS service clients, when required by the French health authority. **Note:** all requests must be submitted by formal request in accordance with current legislation. ### 4. How Plenit handles these requests ![](https://jotelulu.com/wp-content/uploads/2025/11/Frame-03-e1763484430988.jpg) ### 5. Special cases **HDS clients (France)**\ French regulations may require the communication of contact details to the health authority, in particular the designated contact during the organization’s registration under the HDS service.\ Plenit will inform the partner in advance, unless the law expressly prohibits such notification. **Requests from foreign authorities**\ They will only be handled if they are covered by European regulations or valid international treaties.\ Any request outside that framework will be formally rejected. ### 6. Principles of transparency and security Plenit applies the fundamental principles of the GDPR in all processes: * **DPO intervention (Data Protection Officer):** all requests are reviewed and validated by them. * **Data minimization:** only the necessary information is provided. * **Traceability and recordkeeping:** the entire process is documented, from receipt to final response. * **Confidentiality:** exchanges are carried out securely and encrypted, in accordance with the principles of *privacy by design*. ### 7. What you should do as a partner Your cooperation is essential to ensure compliance. * Keep your clients’ information up to date on the Plenit platform. * Designate a valid point of contact for privacy or compliance communications. * Coordinate with the Plenit team if a request affects your clients or services. * Inform your end clients when required by law. * Keep an internal record of the requests and responses handled. **Tip:** if you manage clients with HDS services, also consult the tutorial **How to register a client for the HDS service** to learn about the specific obligations in France. ### 8. Limitation of liability Plenit always acts in accordance with current legislation and the provisions of the GDPR. However: * The final responsibility for client data lies with the partner when acting as Data Controller. * Plenit shall not be liable for penalties or claims arising from improper use of data by the partner or third parties. * In case of doubt, the partner should consult its legal advisers or its DPO before responding to any authority. ### 9. Contact For any inquiries related to the handling of requests under the GDPR:\ 📧 \**\[]\** 🛈 **Note:** this channel is intended exclusively for compliance and privacy matters. ### 10. Conclusion Proper handling of requests under the GDPR requires coordination, transparency, and traceability.\ Knowing your role as a partner will allow you to act with legal certainty and maintain your clients’ compliance.\ For its part, Plenit ensures that all processes respect the principles of lawfulness, minimization, and proactive accountability established by the European Regulation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.plenit.com/docs-en/platform/security/how-to-handle-gdpr-authority-requests.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.