Data Policy

Create data policy

POST/v4/config/consent/policy

Creates a data policy: the privacy policy URL and the processing rules (jurisdiction, retention period, storage location, third party sharing) of your organisation. The server sets the ID and the version 1.0.0, and saves the first revision.

Use a data policy as the source of the policy of your data agreements. A data agreement keeps its own copy of the policy, so a later change of the data policy does not change the data agreements. When the new data policy is the only data policy of the organisation, the server also sets its URL as the policy URL of the organisation.

Create data policy

Language of the request sample

curl -X POST 'https://demo-api.igrant.io/v4/config/consent/policy' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "policy": {
    "name": "Privacy policy",
    "url": "https://www.example.com/privacy-policy",
    "jurisdiction": "Sweden",
    "industrySector": "Retail",
    "dataRetentionPeriodDays": 365,
    "geographicRestriction": "European Union",
    "storageLocation": "Sweden",
    "thirdPartyDataSharing": false
  }
}'

{
  "policy": {
    "id": "6af080a42d6fb7b6ac6efc54",
    "name": "Privacy policy",
    "version": "1.0.0",
    "url": "https://www.example.com/privacy-policy",
    "jurisdiction": "Sweden",
    "industrySector": "Retail",
    "dataRetentionPeriodDays": 365,
    "geographicRestriction": "European Union",
    "storageLocation": "Sweden",
    "thirdPartyDataSharing": false
  },
  "revision": {
    "id": "6af080a42d6fb7b6ac6efc55",
    "schemaName": "Policy",
    "objectId": "6af080a42d6fb7b6ac6efc54",
    "signedWithoutObjectId": false,
    "timestamp": "2026-11-08T14:01:08Z",
    "authorizedByIndividualId": "",
    "authorizedByOther": "6ae2bf74a401855d2806ab5d",
    "predecessorHash": "",
    "predecessorSignature": "",
    "objectData": "{\"id\":\"6af080a42d6fb7b6ac6efc54\",\"name\":\"Privacy policy\",\"version\":\"1.0.0\",\"url\":\"https://www.example.com/privacy-policy\",\"jurisdiction\":\"Sweden\",\"industrySector\":\"Retail\",\"dataRetentionPeriodDays\":365,\"geographicRestriction\":\"European Union\",\"storageLocation\":\"Sweden\"}",
    "successorId": "",
    "serializedHash": "5172776ed742c08df985f58fcbe3afd641c0f862",
    "serializedSnapshot": "{\"schemaName\":\"Policy\",\"objectId\":\"6af080a42d6fb7b6ac6efc54\",\"signedWithoutObjectId\":false,\"timestamp\":\"2026-11-08T14:01:08Z\",\"authorizedByIndividualId\":\"\",\"authorizedByOther\":\"6ae2bf74a401855d2806ab5d\",\"objectData\":\"{\\\"id\\\":\\\"6af080a42d6fb7b6ac6efc54\\\",\\\"name\\\":\\\"Privacy policy\\\",\\\"version\\\":\\\"1.0.0\\\",\\\"url\\\":\\\"https://www.example.com/privacy-policy\\\",\\\"jurisdiction\\\":\\\"Sweden\\\",\\\"industrySector\\\":\\\"Retail\\\",\\\"dataRetentionPeriodDays\\\":365,\\\"geographicRestriction\\\":\\\"European Union\\\",\\\"storageLocation\\\":\\\"Sweden\\\"}\",\"organisationId\":\"\"}",
    "organisationId": "6ae2bf741c3dadfeb27982ec"
  }
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:data-agreements:create

Body

application/json

policyobjectrequired
A data policy: the privacy policy and the processing rules under which the organisation processes the data. Each update makes a new revision and raises the major version.

Response

application/json

The data policy and its first revision.

policyobject
A data policy: the privacy policy and the processing rules under which the organisation processes the data. Each update makes a new revision and raises the major version.
revisionobject
One saved version of a record (a data agreement, a policy, a consent record or a data disclosure agreement). Each change makes a new revision. The revision holds the record as JSON and a SHA-1 hash of the snapshot, and it links to the hash of the revision before it, so that you can detect a changed history. Only successorId changes after the server saves a revision.