Handle a privacy request
Work a data subject request from arrival to a recorded response, inside the GDPR's one-month deadline.
Data subject requests live on the Requests tab of Compliance › Privacy, in a queue headed Privacy requests. Everyone in your workspace can work them, and so can a DPO you've engaged. The same requests also appear in your Inbox, where a row opens the same drawer.
Where requests come from
- The request form on your Privacy Center. The data subject files the request themselves, and its Source reads Privacy Center form. The form is live only while the Privacy register is open. Your workspace gets a notification, and the primary contact named under Settings › Organization gets an email. See Privacy Center basics.
- Requests you record. When someone emails, phones or writes to you, select Record request. Log a privacy request asks for the Framework, which sets the response window, the Request type, Received via (Email, Phone call, Postal letter or Other) and the Date received, where the clock starts. Then come the requester's details, a one-line Subject, the Body / context and an optional owner under Assign to.
Either way, the subject is emailed a receipt with the request type, the date it was received, the date the response is due and a reference.
Work the queue
The tiles count Open requests, New (untriaged), In progress and Avg days to close. Search by name, email or summary, or narrow the queue with the Status, Type, Framework and Received filters.
The SLA column counts down to the due date, for example 12d left, and reads Overdue 3d once it has passed; an extended request adds · extended. A subject's address that hasn't been confirmed yet is marked Unconfirmed; see Verify a requester's identity.
To give a request an owner, open it and select Hand over beside Assigned to. To hand over several, tick them and select Reassign… in the bar that appears. Nobody is emailed, and handing over doesn't change a request's status.
Statuses
| Status | What it means |
|---|---|
| New | Where a request starts, unless you ask for ID while recording it. Handing it over or extending it doesn't move it on. Edit details, in the drawer's menu, is offered only at this status. |
| Awaiting subject | You've asked the subject for a government ID. |
| In progress | The ID you asked for has arrived, or you cancelled the ask. |
| Resolved | You recorded the response. Closed. |
| Rejected | You rejected it with a reason. Closed. See Reject a privacy request. |
| Withdrawn | The subject withdrew it from your Privacy Center. Closed. |
Record the response
The drawer's main button is named for the request type and opens a form shaped by it. Record response and resolve saves the response and closes the request.
| Request type | Button | What you record |
|---|---|---|
| Access | Send fulfillment | The files you're handing over, at least one |
| Portability | Send data export | The exported data as files, at least one |
| Erasure | Confirm deletion | Optionally, each system and whether its data was Deleted, Anonymised or Retained, with the lawful basis for anything retained |
| Rectification | Confirm correction | Each field corrected and what it now says |
| Objection | Send decision | Objection upheld — processing stopped or Objection rejected — processing continues, with your reasoning |
| Restrict processing | Confirm restriction | From when, what it covers and, optionally, for how many days |
| Opt-out of sale, Opt-out of targeted ads | Confirm opt-out | From when, and what it covers |
Each form also takes an optional Covering message and up to 10 files of up to 10 MB each, 25 MB together. If you resolve an access, erasure or portability request without a verified ID, the form warns you first; you can still send it.
The platform doesn't send your response. Send it yourself, on the channel the request came in on. What the subject gets from us is a notice that the request is closed, with a seven-day link to the request's page on your Privacy Center, where the files you attached can be downloaded.
What the subject receives
| When | Email subject, for an access request |
|---|---|
| The request is filed | Your access request to [company] |
| It was filed on your Privacy Center, to confirm the address | Confirm your email address for your request to [company] |
| You ask for a government ID | [company] needs to confirm your identity |
| You extend the deadline | More time needed on your access request to [company] |
| You reject it for any reason except Spam | [company] is not taking action on your access request |
| You resolve it | Your access request to [company] is closed |
[company] is your company's legal name from Settings › Organization, since we send in your name as the controller. The drawer's Communication section lists each email sent, and Receipt shows whether the first one went out.
Deadlines
Deadline. GDPR Article 12(3): tell the subject what action you've taken on the request without undue delay, and at the latest within one month of receipt. You can extend that by two further months where necessary, given the complexity and number of requests, if you tell the subject within the first month, with the reasons. Under Article 12(4), if you won't act on a request, tell the subject within one month why not, and that they can complain to a supervisory authority and seek a judicial remedy.
For a GDPR request the platform counts a calendar month from the Date received, or uses the shorter window you've committed to. Other frameworks use their own windows. See Extend a request's deadline and Choose your privacy frameworks and response windows.