Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

In this Discussion

osTicket v1.10 (stable) and Maintenance Release v1.9.15 are now available! Go get it now


Our IT guys asks me if Osticket is GDPR compliant ? Doesn anyone know anything about this ?



  • I would probably say no, based on the following statements.
    • osTicket does not delete old data by itself, that you would have to configure yourself.
    • osTicket does store personal data by default, but this can be altered to your business needs.
    • If a user requests that all data about them gets deleted, you can do so by simply deleting the user account, there is however no proof provided by osTicket that it was deleted except a success message and that you shouldn't be able to find them.
    • If a user requests all data about them, it would be a manual task, but the tool can print out a list of the tickets and then each ticket can be exported as a pdf manually. I don't think you can export the user profile data but you can probably just take a printscreen.
    Most of these problems can probably be solved by implementing some sql queries that you'd use if the need arise.

    That's what comes to mind for me but it's very vague to ask if osTicket is GDPR complaint, it's not like there's a certificate.
  • Considering I had never even heard of GDPR until this thread, I would say no.
  • Software itself is not regulated by GDPR, it's the actual data and you'll need to consult legal assistance to ensure compliance. 
  • This will be a big issue if osTicket is not GDPR compliant before May 25, 2018. Because it manages data about people.
    Some features would be useful to make it compliant:
    - ability to remove the attachments older than a a specific age
    - mark some data as sensitive and crypt them in the database
    - ability to anonymise the personal data (ip, email) after a certain period
  • edited March 15
    I don't feel like you are going to like my more verbose answer but here goes:

    My understanding is the the devs plan on being complaint, but feel that it mostly depends on the the hosting end of things, not the software per se.  That being said I'm sure that I will be getting more information regarding this in the future and it would probably slated for a 
    future v 2.1 or higher release.

    Since osTicket is open source, that means that you can modify the core files to suit your needs.  If you want a specific feature [like those you mentioned] you can develop it, or pay for someone else to develop it for you or the community.
  • Thank you for your answer.

    By the way, do you know why I don't receive any notification when you post an answer?
    For information, in my notifications settings, all the options are checked except "Notify me when a comment is flagged."
  • Hi, I feel like this topic was not taken seriously enough.

    Sure, I understand that osTicket is open source and developers will not drop their current responsibilities to make osTicket compliant without any bonification. Perhaps someone can take this challange and prepare the plugin that will help to comply (This can be released commercially).

    If it is known (and will be known) that osTicket does not have features to ease complaince (or namely manual actions and procedures need to be in place to comply), then anyone after 28.05.2018 who will want to mess up, will start making problems to companies that use osTicket. Needless to say how popular it is and how much issues it may cause.

    I need to either switch from osTicket by the deadline (last thing I want to do) or prepare manually scripts and instructions how to i.e delete user or replace his personal data with some auto-generated jibberish. Considering how many people are facing the same task, it seems dumb that we are left alone.

    I would really appreciate some official statement from developers what is the plan. There is only 2 months to wrap it up and I bet internally all companies have their own deadline to present compliance report. If that is a paid service, let it be.

  • You are welcome to your opinion.   

    "or prepare manually scripts and instructions how to i.e delete user or replace his personal data with some auto-generated jibberish."

    Here are the instructions on how to delete a user that you requested.

    Go to Users tab.
    Find user.
    Click check box to left of user.
    Click More
    Click Delete

    You have already received an official response from me, the forum moderator which was written after I spoke to the lead Dev.

  • I would like to see a feature manage all attachments in some kind of list view with a fetaure to mark attachment as  [ secure / not tested yet / should be removed / replaced / removed ]
    I would like to see in this new feature, a new list view an feature to edit or replace images and all other type of attachments.

    By replacing or removing attachment, should be automaticaly send email to posters as an information that we remove not legit content with additionall description.

  • edited April 12
    Just my two cents if anyone is looking for a way to deal with attachments with limited amount of Linux skills.

    For Linux users who use file attachment plugin to store files on the server and not in the database, it is pretty easy to deal with attachments with a simple find command:

    find /path/to/files* -mtime +365 -exec rm "{}" \;
    find /path/to/files* -mtime +365 -delete

    (where 365 is days and -exec rm is self explanatory)

  • I'm unsure why you would be deleting attachments without deleting the entire ticket so I thought I would mention this plugin:

    You can use it to completely wipe out tickets of a certain age, the additional archiving options can be set to not be used so it is simply deleting tickets on your schedule.

    It perhaps could be extended to include some of the requested features such as specific user targetting with reporting of said deletion etc.

    Another extension or plugin might be to archive/delete user records after a certain time period. In bigger orgs they certainly start to add up fast and probably are not required ever again.

  • Export all user data would be useful. Letting either agents or users package up all known info. Might be a useful upgrade to the archiver plugin, good idea Perry. :-) At least you would be able to say what you'd deleted.

    How exactly can anyone prove data has been deleted completely though? Do they think data is never being backed up? Is it enough to say that it is? IANAL.
  • @pcjkollmorgen, the idea behind just deleting the attachment (at least in one case) is if your attachment contains data about thousands of peoples and the ticket requires you to do something based on the data (e.g., sql query), once the task has been completed, you still want a record on your system about why this action was done, but without the sensitive data attachment.

    At least, that was my idea behind cron delete :)
  • Sure if the attachments are sensitive then it makes sense to remove/encrypt/anonymise or whatever is best suited for you and also doesn't lead to OsTicket itself starting to report errors.

    I've just remembered and tested also you cannot delete only users in OsTicket from the web interface. It will prompt to additionally delete all tickets and attachments associated with that user and you have to delete the lot. So you couldn't easily have a ticket which shows as belonging to a "deleted user".

    Maybe the archiver plugin could do a search after it has deleted tickets and any users who have no tickets to their name and who haven't logged in for a long time could be flagged for archive also.

    I was wondering about backups also. It looks like it is mostly ok if you can explain how long your backups remain etc and that it isn't generally possible to selectively edit backups. IANAL.

  • edited April 24

    Ehh @ntozier .... if osTicket is not GDPR compliant by May 25th your Company will be ruined. Im just stating the facts. You will loose many customers and all companies using osTicket will be fucked. Please take GDPR seriously since this is a huge law in Europé with insane penality fees if broken.

    Everyone owning a business in Europé or having lots of customers from EU will have to be GDPR compliant to survive.

  • edited April 24
    @poisony Whether or not I (a forum administrator for an open source project) take laws passed across the pond seriously or not does not help you or anyone else.   I am not a dev.  Lastly I would add that I do take it seriously, I'm a big advocate for the right to be forgotten, privacy for citizens, etc. 
  • @poisony
    in principle it is not a software/application compliace, but company procedure. Which means if your admin knows how to delete account or anonymize data and you write an internal procedure what he needs to do if such request appears - that's ok. But ...

    @ntozier ... I am talking about some data anonymizing script. I can't just keep deleting stuff if I am afraid of its content :D. How's that supposed to work, our partner ends cooperation with us and asks to delete his 10 employees' accounts, so I first need to delete 200 tickets and then 10 accounts. Fine, but how about our internal statistics? This all gets wasted. I need to save tickets and data, problems and solutions, just need to get rid of Personally Identifiable Information.

    Devs, please, act!

  • @Kacper: stats are deduced from the events table, not ticket itself, so deleting a ticket shouldn't need to delete stats for staff.
  • If you dont want to delete data, my opinion is to rename data to something general. For example, instead of deleting stuff, i prefer to change all fields of stuff to "OLDSTUFF". I can delete attachements of tickets after x days from date created with a query and also change text in ticket fields and messages, again after x days with a query. 
  • @Grizly, it is not only about "stats" but also the information int he ticket. Each ticket is a case study, if solution was provided. I dont want to just delete stuff. I want names and emails to be anonymized. As far as I know php/mysql I would say it is not a big deal. I just dont find it reasonable to develop it myself, because I would need to spend 10 x more time to make it work than devs who know osTicket and also I would need to keep adjusting it every time osTicket gets an update.
Sign In or Register to comment.