Restrict Data Processing for Heroku

Some situations require you to prevent the processing of your customers’ data. We give you actions to consider so that you can work toward complying with the laws that are important to your company.

Required Editions

Available in: All Editions

Various laws and regulations require you and your company to sometimes restrict the processing of your customers’ data. We’ve listed a few of the laws that are important to many companies collecting and processing their customers’ data.

General Data Protection Regulation (GDPR), European Union 
Federal Rules of Civil Procedure, United States

If you encounter situations that require you to restrict data processing for any of your customers, review these common requests and the procedures related to them.

Common Customer Request	Actions to Consider	Things to Consider
My customer stopped doing business with us. Although we no longer need the customer’s data, we were asked to keep it because of a legal proceeding that possibly needs the data.	Heroku Services give you the ability to fully manage the development, design, and functionality of applications you deploy. Using Heroku Services, you can design and develop application-layer functionality that allows your organization to implement restrictions on data processing. Customers might also consider leveraging the following features and functionality available in Heroku managed add-ons to assist them in addressing such requests from end users of applications deployed to Heroku Services. Heroku Postgres provides the following data export and copy features for selected Heroku Postgres plans. Heroku Postgres Dataclips allow your organization to generate a URL that can be accessed to download selected data in various formats. Database backups can be generated using Heroku PGBackups or your organization can leverage the pg_dump PostgresSQL tool to generate backups. Heroku Connect can be used to synchronize Heroku Postgres data to an existing Salesforce Services org. Create a database fork which creates a snapshot of an existing database at the current point-in-time. Heroku Redis is not meant for long-term data persistence. Your organization should store data you wish to persist in Heroku Postgres and leverage the Heroku Postgres data export capabilities described previously. Heroku Kafka includes support for Kafka Consumers that your organization can utilize to export data to Heroku Postgres or to external systems. Your organization can also request full copies of sensitive data submitted to Heroku Services by visiting Heroku Support.	Work with your legal team to understand the types of data processing requirements that apply to your business. Export the customer’s data to retain it.
My customer told me that the personal data we have on file is inaccurate. Because of those errors, the customer wants us to stop processing their data until we’ve verified the data’s accuracy.	Heroku Services give you the ability to fully manage the development, design, and functionality of applications you deploy. Using Heroku Services, you can design and develop application-layer functionality that allows your organization to meet data processing restrictions. For example, ceasing further processing of data for your application’s end users until your organization has verified data accuracy and also for obtaining and tracking these end-users’ approval to resume processing of their data.	For selected plans, data changes made to your primary Heroku Postgres databases can be configured to replicate to Follower databases. However, data changes are not propagated to completed backups created using Heroku PGBackups or the pg_dump PostgresSQL tool, or previously forked databases. Therefore, customers should consider tracking any data changes and propagating these changes to forked databases, when restoring database backups created using PGBackups or the pg_dump PostgresSQL tool, or when performing a Heroku Postgres Rollback. Are there other places that this data is stored? Restrict processing on that data as well and work with your customer to verify the data’s accuracy. Then, get their approval to resume processing their data.

Common Customer Request

Actions to Consider

Things to Consider

My customer stopped doing business with us. Although we no longer need the customer’s data, we were asked to keep it because of a legal proceeding that possibly needs the data.

Customers might also consider leveraging the following features and functionality available in Heroku managed add-ons to assist them in addressing such requests from end users of applications deployed to Heroku Services.

Heroku Postgres provides the following data export and copy features for selected Heroku Postgres plans.

Heroku Postgres Dataclips allow your organization to generate a URL that can be accessed to download selected data in various formats.
Database backups can be generated using Heroku PGBackups or your organization can leverage the pg_dump PostgresSQL tool to generate backups.
Heroku Connect can be used to synchronize Heroku Postgres data to an existing Salesforce Services org.
Create a database fork which creates a snapshot of an existing database at the current point-in-time.

Heroku Redis is not meant for long-term data persistence. Your organization should store data you wish to persist in Heroku Postgres and leverage the Heroku Postgres data export capabilities described previously.

Heroku Kafka includes support for Kafka Consumers that your organization can utilize to export data to Heroku Postgres or to external systems.

Your organization can also request full copies of sensitive data submitted to Heroku Services by visiting Heroku Support.

Work with your legal team to understand the types of data processing requirements that apply to your business.

Export the customer’s data to retain it.

My customer told me that the personal data we have on file is inaccurate. Because of those errors, the customer wants us to stop processing their data until we’ve verified the data’s accuracy.

Heroku Services give you the ability to fully manage the development, design, and functionality of applications you deploy. Using Heroku Services, you can design and develop application-layer functionality that allows your organization to meet data processing restrictions. For example, ceasing further processing of data for your application’s end users until your organization has verified data accuracy and also for obtaining and tracking these end-users’ approval to resume processing of their data.

For selected plans, data changes made to your primary Heroku Postgres databases can be configured to replicate to Follower databases. However, data changes are not propagated to completed backups created using Heroku PGBackups or the pg_dump PostgresSQL tool, or previously forked databases. Therefore, customers should consider tracking any data changes and propagating these changes to forked databases, when restoring database backups created using PGBackups or the pg_dump PostgresSQL tool, or when performing a Heroku Postgres Rollback.

Are there other places that this data is stored? Restrict processing on that data as well and work with your customer to verify the data’s accuracy. Then, get their approval to resume processing their data.