Quickstart

This guide walks your engineering team through the full Data Broker Compliance implementation — from connecting your systems to receiving your first DROP deletion request. Complete each step in order before moving to the next.

Prerequisites

Before starting, ensure your privacy team has:

• Reviewed the Overview and identified all in-scope systems
• A DataGrail account with Super Admin or Connections Manager access
• Credentials for each system you are connecting

---

Prepare for Implementation

Before configuring anything in DataGrail, complete the following steps with your privacy and engineering teams.

Determine applicable data and identifiers Review what personal data your organization collects and decide which identifier types apply to DROP compliance — for example, email addresses, phone numbers, or device identifiers. This determines which DROP registry lists DataGrail subscribes to on your behalf. See Identifier Configuration for the full list of available types.

Identify which internal systems hold this data Map the identifier types you selected to the internal systems that store them. These are the systems you will connect in the next step. If any systems are proprietary or not in the DataGrail integration catalog, plan to use an Internal Systems Integration.

Standardize and hash your user data Before delivering consumer identifiers to DataGrail, your data must be standardized and hashed according to the DROP specification. Review the Hashing Algorithm documentation carefully — your hashes must exactly match the DROP standardization rules for identity matching to work.

---

Connect Your In-Scope Systems

DROP Compliance is configured per broker registration from the DROP Compliance > Settings tab, in the DROP Integrations section — not from a general integration's Enabled Capabilities settings.

Set a Primary Transport

Your primary transport resolves and reports on DROP requests. It must be connected as either an ISI (Internal Systems Integration) or a Webhook.

1. Navigate to DROP Compliance > Settings in the left sidebar.
2. Under Primary Transport, select Connect New Integration.
3. Select ISI (Internal Systems Integration) or Webhook from the menu.
4. Complete the connection setup. You'll return to the Settings tab with the new integration selected as your primary transport.
5. Select Save.

Add Secondary Deletion Integrations

Secondary deletion integrations delete matched records once your primary transport confirms a match.

1. Under Secondary Deletion Integrations, select the checkbox for each eligible integration you want to include.
2. Select Save.

Eligibility

Only integrations with DROP Deletion already enabled appear in this list. Today, that capability is available by default on ISI (Internal Systems Integration) connections; it is not currently supported on other integration types.

Internal Systems

If your in-scope system is a first-party data store not available in the DataGrail integration catalog, connect it using an Internal Systems Integration.

---

Choose a Deletion Dispatch Method

When DataGrail finds a match in the DROP registry, it needs to notify your systems to perform the deletion. Choose the dispatch method that best fits your infrastructure.

Method	How it works	Best for
Webhook	DataGrail POSTs to a URL you configure	Teams with existing webhook infrastructure
ISI (Internal Systems Integration)	DataGrail calls your hosted API directly	Teams that already have an ISI API or want full control over deletion logic

See API Reference for the full technical specification for each dispatch method.

---

Configure Identifier Types

Select the DROP list types that match the personal information your in-scope systems hold. DataGrail subscribes to DROP registry lists on your behalf based on your selections.

1. Navigate to DROP Compliance in the left sidebar.
2. Select the Settings tab, and locate DROP List Selections.
3. Toggle on each identifier type that matches personal information held in your connected systems. Your selections save automatically.

See Identifier Configuration for the full list of available identifier types and guidance on which to select.

---

Deliver Consumer Identifiers

Before DataGrail can match DROP registry deletion requests against your data, you need to deliver your consumer identifiers to DataGrail via cloud storage.

DataGrail recommends the pre-hashed ingestion path — you apply the DROP standardization and hashing rules before sending, and DataGrail stores and matches the hashes directly. This ensures raw PII never leaves your environment.

To set up your ingestion pipeline:

1. Create a cloud storage bucket (AWS S3, GCS, or Azure Blob Storage) or dedicate a prefix in an existing bucket.
2. Grant DataGrail read-only access to the prefix.
3. Configure the bucket and prefix in DataGrail under DROP Compliance > Settings.
4. Produce your first NDJSON file of consumer identifiers following the Ingestion Format specification.
5. Write a manifest.json referencing the file and upload both to your bucket.

DataGrail will automatically pick up the manifest within 15 minutes and begin ingesting your identifiers.

Pre-Hashed vs. Clear

If you choose pre-hashed ingestion, read Hashing Algorithm carefully before building your pipeline. Your hashes must exactly match the DROP standardization rules for identity matching to work.:::

---

Implement Your Dispatch Endpoint

Based on the dispatch method you chose in Step 2, implement the appropriate endpoint or agent before go-live.

• Webhook: Set up a receiver endpoint at the URL you'll configure in DataGrail. Implement signature verification and return 2xx on receipt.
• ISI: Implement the /api/v1/privacy/drop/delete and (if needed) /api/v2/privacy/drop/identifiers endpoints on your hosted API.

Refer to API Reference for the full request/response specifications.

---

Test End-to-End

Before going live, run at least one full test deletion request to verify the entire pipeline is working correctly.

See Testing & Validation for the complete testing checklist and common troubleshooting steps.

Once testing passes, DataGrail will begin monitoring the DROP registry and processing deletion requests on your behalf automatically. DROP requests will appear in your Request Manager queue alongside all other privacy requests.

For ongoing monitoring, use the Audit Log & Reporting to track deletion status and 45-day SLA compliance.