Pseudonymize a user (GDPR right to erasure)
When a user exercises their GDPR Art. 17 right to erasure ("right to be forgotten"), MobilityManager pseudonymizes their personal data rather than deleting records outright. This replaces identifying fields with a non-reversible placeholder while preserving the record structure needed for compliance. This article explains exactly what the operation scrubs and how to run it.
Required role and permission
You need the users:manage permission, and your account must hold the SystemAdmin role. The service enforces the SystemAdmin requirement in addition to the permission check, so a FleetManager who happens to have users:manage still cannot complete the operation.
How to pseudonymize a user
- Confirm the target user's ID.
- Run the eligibility check first (
GET /api/gdpr/can-pseudonymize/{userId}) to make sure the account is eligible. - Submit the erasure request to
POST /api/gdpr/pseudonymizewith the body{ "userId": <id> }. - Record the returned pseudonym ID and the statistics (users, drivers, and audit entries updated) as evidence that the request was fulfilled.
The generated pseudonym looks like Deleted User #00042-58391, combining the user ID with a random suffix so it is unique.
Exactly what data is scrubbed
The operation reaches both the system database (the login account) and every tenant database the user belonged to.
| Database | Record | What changes |
|---|---|---|
| System | User | Username and email set to the pseudonym; first and last name cleared; password hash emptied; password-reset token and expiry cleared; OIDC subject and provider cleared; account deactivated. All tenant role assignments are removed, so the user can no longer sign in. |
| Tenant | Driver | First name set to "Deleted", last name to "User", email set to the pseudonym; phone, license number, and license expiry date cleared; the driver is deactivated. |
| Tenant | DriverLicenseProfile | The regulated Führerschein (driver-license) number and issuing country code are emptied. This is the authoritative license number and is scrubbed separately so no strong identifier is left behind. |
| Tenant | AuditEntry | The user's email on their past actions is replaced with the pseudonym. All other audit fields are preserved. |
Warning: Pseudonymization is irreversible. The original username, email, names, and license numbers cannot be recovered afterward. Confirm you have the correct user ID before submitting.
Why the tenant list is captured first
The operation reads the user's tenant memberships before removing their role assignments. If it read them afterward the list would be empty, and driver and license data would be silently left in place. Capturing the tenants first guarantees that per-tenant PII is erased everywhere the user was a member.
Note: Audit history is intentionally kept. Timestamps, actions, entity types, and entity IDs remain so your organization can still demonstrate what happened, only without the person's identity attached.
Related
- Check whether a user can be pseudonymized
- Who can run GDPR actions
- GDPR compliance in MobilityManager
- View a user's audit history
