How to export or purge a lead's data for a GDPR request

GDPR requests start at the Modify Lead page

When a data subject submits a GDPR right-of-access or right-to-erasure request, your first stop in VICIdial is the Modify Lead page. You can reach it two ways: through Lists -> Search for a Lead, or by clicking a lead ID in the User Stats page.

At the bottom of the Modify Lead page, if the GDPR features are enabled, you will see a GDPR compliance section with two distinct options.

Option 1: Download GDPR-formatted data

The download option fulfills a right-of-access request under Article 15. When you click Click here to download GDPR-formatted data for this lead, VICIdial generates a ZIP file containing:

• All lead record fields (name, phone numbers, address, custom fields)
• All call log and activity data associated with the lead
• All available call recordings linked to that lead record

This ZIP is the complete data package you deliver to the data subject. It covers the Article 15(3) requirement to provide a copy of the actual data and gives you a single file to attach to your response. Note: your PHP installation requires the ZipArchive class for this to work on non-VICIbox servers.

Option 2: Review and purge customer data

The purge option fulfills a right-to-erasure request under Article 17. Clicking Click here to review and purge customer data on lead takes you to a confirmation page where you can permanently delete the personal information stored in the system. This action is irreversible, so the confirmation step exists specifically to prevent accidental deletion.

When system setting is at 2, deletion includes Call recording files — not just the lead record data. When it is set to 1, only the download option is available and the purge option is not shown.

How the system and user settings interact

flowchart TD
  A[Admin sets System Setting] --> B{Value?}
  B -- 0 --> C[GDPR options hidden everywhere]
  B -- 1 --> D[Download enabled system-wide]
  B -- 2 --> E[Download and Delete enabled]
  D --> F[User setting max is 1]
  E --> G[User setting can be 1 or 2]
  F --> H[User sees download only]
  G --> I{User setting value?}
  I -- 1 --> H
  I -- 2 --> J[User sees download and purge]

There are two tiers of control. The system-level setting under Admin -> System Settings sets the ceiling. Each user's GDPR-Compliant Export Delete Leads setting under Users -> Modify User controls what that individual can do — but you cannot set a user's permission higher than the current system setting. This means supervisors can hold download-only access while compliance officers have full purge access, all within a single system.

Best practice: download before you purge

Even when responding to a pure erasure request, download the GDPR ZIP first. It creates a timestamped record of what data existed at the time of the request — useful for demonstrating compliance if the deletion is ever audited. Store the ZIP securely and separately from your main Lead list infrastructure.

For context on who is required to comply with these rules, see who is affected by GDPR, even outside the EU. For the full compliance picture, visit the VICIdial compliance overview.

VICIfast managed hosting includes GDPR setting configuration as part of onboarding. See pricing for details.