Using policies to comply with a request from a person for data that pertains to a person

A non-transitory machine-readable medium that provides instructions that, if executed by a processor, are capable of causing operations for using policies to comply with a request from a person for data that pertains to the person, pursuant to applicable data privacy laws, the operations comprising:

• responsive to receiving a query submitted by a user of a database that includes an identifier for a policy and data to identify records that store data pertaining to the person, retrieving the policy corresponding to the identifier for the policy, wherein the policy is configurable to reflect a manner to comply with the applicable data privacy laws and indicates first and second database objects of the database from which to retrieve data and for those first and second database objects, respective first and second sets of one or more fields from which to retrieve data, wherein the respective first and second sets of one or more fields store data that pertains to persons;
• applying the policy, the applying comprising:
• determining, based on the data to identify records, that data is to be retrieved from a first record of the first database object,
• determining, based on information included in the policy, that data is to be retrieved from the first set of one or more fields of the first database object and the second set of one or more fields of the second database object,
• retrieving, from the first database object, data stored in the first set of one or more fields of the first record as a first set of values, wherein the first record is associated with the data to identify records, and
• retrieving, from the second database object, data stored in the second set of one or more fields of a second record as a second set of values, wherein the retrieving is based on a key that is shared by the first and second records,
• wherein permissions granted to the user on the database are disregarded when applying the policy that was identified in the query submitted by the user by having a different user of the database with elevated privileges perform the retrieving from the first database object and the retrieving from the second database object to favor compliance with the applicable data privacy laws reflected by the policy over the permissions granted to the user;
• and
• storing, in a document, each value of the first and second set of values and, for each value, a name for a respective field of the first and second sets of one or more fields from which the value was retrieved.