Reject a privacy request
Close a request you won't act on, one at a time or in bulk, with a reason the subject is told.
Rejecting closes a request without the response it asked for. Under GDPR Article 12(4), if you don't act on a request you must tell the subject, at the latest within one month of receipt, why not and that they can complain to a supervisory authority and seek a judicial remedy. The platform sends that email for you, except for spam.
Pick a reason
| Reason | Meant for | Subject told |
|---|---|---|
| Not legally required to respond | A request that is manifestly unfounded or excessive, or outside what its framework obliges you to answer | Yes |
| Identity could not be verified | Identity proof was asked for and nothing that satisfied it arrived | Yes |
| Spam | A submission that isn't a data subject request at all, such as an automated or fraudulent one | No: closed silently |
| Other | Anything else, in your own words | Yes |
Reject one request
- Open the request and select Reject.
- In Reject the request, pick a Reason. For Other, write the Explanation, up to 1,000 characters, in plain language: these are the words the subject is given.
- Select Reject and notify, or Close as spam for spam. Keep it open backs out.
This can't be undone. Nothing on the platform reopens a rejected request or extends it.
Reject several at once
- Tick the requests in the queue; a bar appears with the count.
- Select Reject….
- Pick one Reason and, if you want, a Note, which is required for Other. Both are recorded on every request.
- Select the button that counts them, for example Reject 12 requests.
Requests that are already closed are left as they are, and only the ones that move are emailed. Resolving stays one request at a time, because each resolution records its own response.
What the subject receives
For every reason except Spam, the subject is emailed at the address the request came from, with a subject line such as "[company] is not taking action on your access request". The email gives the reason in plain words, your explanation or note, and their right to complain to a data protection authority and seek a remedy through the courts. It also says they can write to you again, quoting the reference, if they now have what was missing. A spam closure sends nothing.
The reason and any explanation are recorded on the request, under Rejected because, and in the audit log.