Entities – PII Reports & GDPR Compliance Tools

This article explains how to use the PII (Personally Identifiable Information) report and mass-update tools in DiliTrust Entities to help your organization comply with data protection regulations, including the GDPR.

✅ Introduction

Organizations that manage legal entities often accumulate personal data on individuals — such as mandate holders, shareholders, proxy representatives, or legal representatives — over many years. Over time, some of these individuals may no longer have any active relationship with your companies, yet their personal data remains stored in the system.

To help administrators comply with data protection obligations (such as the GDPR's data minimization and right-to-erasure principles), DiliTrust Entities now provides dedicated tools to:

• Identify individuals who no longer have active links to any company or role.
• Filter individuals using new date-based criteria (last mandate, last shareholding, last delegation).
• Identify individuals who are no longer referenced by any other record through a custom field that links one record to another — for example a field on a company that points to one or several individuals.
• Empty sensitive personal data fields (such as address) in bulk.
• Delete the full history of a field's values for selected individuals.

✋ Prerequisites / Getting Started

Before using these features, make sure the following conditions are met:

• Administrator role: Only users with the Administrator profile (HQ or local admin) can access the report library, run PII reports, and perform mass updates.
• Access to the Entities module: Your organization must be subscribed to the DiliTrust Entities module.
• Individuals data already entered: The PII report is based on data already recorded in the Persons section (individuals) of your Entities environment.

✨ Feature Overview: What's New

Four capabilities are available to support GDPR compliance workflows in the Entities module:

1. New date-based filters in the Individuals report — identify individuals by when they last held a role.
2. Ability to empty the Address field via mass update — clear sensitive address data for multiple individuals at once.
3. Delete all history records for a field via mass update — permanently remove the tracked history of a field's values across selected individuals.
4. New "Last time referenced" filter, with a "still referenced" column — identify individuals who are no longer referenced by any other record through custom fields that link content together.

⭐ Step-by-Step Guide

Step 1 – Generate an Individuals Report with PII Filters

1. Go to the Reports section from the main navigation menu.
2. Click Create a report or open an existing Individuals report.
3. Set the Content scope to Individuals.
4. In the Filterssection, use the new date-based fields to narrow down individuals who are no longer active:
   • Last time as a mandate holder — filter individuals whose most recent mandate ended before a chosen date.
   • Last time as a shareholder — filter individuals whose most recent shareholding ended before a chosen date.
   • Last time as a delegator — filter individuals whose most recent delegation ended before a chosen date.
   • Last time referenced — filter individuals who have not been referenced by any other record since a chosen date. This covers custom fields that reference other content (multi-content type fields, such as a field on a company pointing to an individual), and it also includes company representatives.
5. You can also use existing filters such as Retirement date, End management date, or Last updated to further refine your selection.
6. Run the report to display the list of matching individuals and their associated personal data fields.

Where references are searched: the Last time referenced filter looks for references to the individual across companies, individuals, mandates, records, shareholders, shares, tasks, workflows, events and documents. When an individual is referenced in several places, the most recent reference date is used.

Still referenced today: when a report uses the Last time referenced filter, a yes/no column is added automatically to the results. It answers a simple question: on the day the report is run, is this individual still referenced somewhere? This column matters because some custom fields are not set up to keep a history of their past values, so a date on its own is not always enough to tell whether the link still exists.

Example: a company record has a custom field named related individual that referenced John Doe and Henry Howell until 02/07/2026. If you filter on individuals no longer referenced after 01/07/2026, and neither person appears in any other reference field, both are returned by the report.

Tip: Use the Managed / Non-managed toggle in the filter panel to include individuals linked to companies not directly managed in your perimeter.

Step 2 – Select Individuals for Mass Update

1. From the Individuals list (or from the report results), select the individuals whose data you want to update.
2. Click the Mass update (bulk edit) button in the toolbar.
3. A dialog will appear confirming the number of selected individuals and a reminder that all changes will be applied uniformly.

Step 3 – Empty Personal Data Fields

1. In the mass update dialog, locate the field you want to clear (e.g., Address, Gender, Birth date).
2. Check the "Empty this field" checkbox next to the relevant field. This will clear the field's value for all selected individuals.
3. Do not enter a replacement value — the purpose is to erase the data, not replace it.
4. Click Confirm to apply the change.

Important: This action is irreversible for the current value. Make sure you have selected the correct individuals before confirming.

Step 4 – Delete Field History Records

1. In the mass update dialog, locate a field that supports historization (i.e., a field that tracks past values over time).
2. Check the "Delete history" option associated with that field.
3. This will permanently delete all past recorded values for that field across all selected individuals.
4. Click Confirm to apply.

Note: The "Delete history" option is only available for fields that support historization in DiliTrust Entities.

✨ Tips & Best Practices

• Use filters before mass-updating: Always run a report first to identify exactly which individuals are concerned before performing any bulk data erasure. This helps you avoid accidental data loss.
• Export the report before erasing: Before emptying fields, export the report as a backup record. This can be useful for audit trail purposes.
• Combine filters: You can combine multiple date filters (e.g., last mandate + last shareholding) to build a precise list of individuals with no remaining active roles.
• Apply GDPR reviews periodically: Schedule a quarterly or annual review using these reports to maintain ongoing compliance rather than addressing data backlogs all at once.
• Document your actions: Keep an internal log of the mass updates performed (date, number of individuals affected, fields cleared) for your organization's compliance records.

❌ Limitations & Known Constraints

• No timestamp tracking for all event types: Certain types of historical events (e.g., specific timeline entries) do not have a timestamp tracked in the system. As a result, filtering by "last activity date" may not cover all possible types of links between individuals and companies.
• Address field only for emptying via mass update (at launch): Initially, the "Empty this field" capability via mass update is focused on the Address field. Other fields may become emptiable in future releases.
• Admin access required: These tools are exclusively available to administrator profiles. Regular users cannot access the PII report filters or perform mass updates.
• Irreversible actions: Emptying a field or deleting its history cannot be undone. There is no recycle bin or restore function for this data.
• A history is needed to obtain an exact date: the Last time referenced filter can only return a precise date when the custom field has been set up as historizable, because that is what records when a reference was added or removed. For fields that are not historizable, rely on the yes/no column to see whether the individual is still referenced today.
• Longer processing time: searching every reference across all content types is a demanding operation. Reports that use the Last time referenced filter can therefore take noticeably longer to run than other reports.
• Bulk update applies uniformly: The mass update applies the same change to all selected individuals. It is not possible to apply different values to different individuals in the same mass update operation.

❓ FAQ

Can I prevent personal data from being collected in the first place?

Yes. In addition to the PII report and mass update tools, your organization can choose to hide some standard fields of individuals, such as Birth date, Gender, Email address, Picture and Address. Hidden fields cannot be seen, added or changed by users, which limits the personal data entered in the platform. Learn more in Create an individual.

Who can use the PII Reports and mass update tools?

These features are reserved for Administrator profiles only (HQ Admins and local Admins with appropriate permissions). Regular users do not have access to these tools.

What types of links are taken into account to determine if an individual is "inactive"?

The report considers the following types of links between an individual and a company:

• Mandates (directorships, officer roles, etc.)
• Shareholdings
• Proxy representatives
• Legal representatives
• Delegations
• Individual custom fields
• Custom fields on other records that reference the individual (multi-content type fields)
• Company representatives

If an individual has no active link of any of these types, they will appear in the PII report.

Can I undo a mass update that emptied personal data fields?

No. Once confirmed, data erasure via mass update is permanent and irreversible. We strongly recommend exporting a report of the affected individuals before performing any bulk deletion.

What is "Delete history" and when should I use it?

Some fields in DiliTrust Entities track changes over time (historization). "Delete history" removes all past recorded values for such a field — not just the current value, but the entire audit trail of previous values. Use this option when you need to comply with a right-to-erasure request and the individual's past data must be fully removed.

Can I filter by "last activity date" across all possible roles at once?

You can apply multiple date filters simultaneously (e.g., last mandate holder + last shareholder). However, note that not all types of historical events have a trackable date in the system, so some edge cases may not be covered by date-based filtering alone.

What exactly does the "Last time referenced" filter check?

In DiliTrust Entities, you can create a custom field on one type of content that references another one — for example a field on a company that points to one or several individuals. The Last time referenced filter scans those references across companies, individuals, mandates, records, shareholders, shares, tasks, workflows, events and documents, and returns the individuals who have not appeared in any of them since the date you select. Company representatives are included in this check.

Why is there both a date filter and a yes/no column?

The date tells you when an individual was last referenced, but it can only be calculated for custom fields that keep a history of their values. The yes/no column completes the picture by telling you whether the individual is still referenced on the day the report is run, including in fields that keep no history. Reading both together gives you a reliable basis before anonymizing or erasing personal data.

A field references an individual but is not historizable. Will the report still detect it?

Yes. The reference is reflected in the yes/no column, which is based on the situation at the time the report is run. What cannot be determined for such a field is the exact date on which the reference was added or removed.

Is there a way to automate the GDPR review process?

At this time, the PII report and mass update must be triggered manually by an administrator. Automated scheduling or alerts for inactive individuals are not yet available. We recommend setting up a recurring internal process (e.g., quarterly review) to run these reports regularly.