Repository: Operational Knowledge Base (Wiki.js)
Associated Runbook: RB-EXTRACT-USER-001
Last Review: 2026-07-06 — AIOps Practice
This procedure governs all user data extractions from in-scope applications:
transaction history, access audit logs, and user profile records.
It covers GDPR Data Subject Access Requests (DSAR), internal audit investigations,
and regulatory compliance inquiries.
A user data extraction request is classified as a Service Request (not an incident).
It adheres to the standard ticket lifecycle and is processed via the Remediation Factory
in assisted mode.
Every request must include the following 5 mandatory elements. If any element is missing,
the request is returned to the requester for clarification (precondition PRE-02 of the runbook):
For GDPR requests, the official DSAR reference and the regulatory deadline (T+30 calendar days)
must be recorded in the ticket.
| Level | Requester Role | Authorized Scope | Secondary Approval |
|---|---|---|---|
| DPO-EXTRACT Level 2 | Data Protection Officer (DPO) | Full (transactions + access logs + profile), any period | None |
| DPO-EXTRACT Level 1 | Business Compliance Officer | Profile + access logs, period <= 12 months | None |
| AUDIT-EXTRACT | Internal Audit | Full, within scope of referenced audit mission | Mission reference mandatory |
| MGR-EXTRACT | Team Manager | Access logs of direct reports only, period <= 3 months | HR validation required |
| — (out of matrix) | Any other requester | None | Hard block — routed to Cockpit |
Rule: Authorization is validated against the named beneficiary/requester in the ticket,
never against the technical submitter. Any out-of-matrix request is blocked and routed
to the Cockpit with reason "requester unauthorized".
| Application | Portfolio | Extraction Connector | Available Data |
|---|---|---|---|
| TradeFlow | Post-Trade | Operational | Transactions, access logs, user profile |
(Catalogue expands as additional applications are onboarded.)
User data extractions are treated as routine Service Requests:
default priority is Normal (P3), with a strict due date set when bound by regulatory
constraints (DSAR: T+30). A regulatory deadline expiring in less than 5 business days justifies
escalation to P2 (High).