Handling requests about personal information

Definition

A data subject request, or consumer request, is somebody exercising a legal right over the personal information you hold about them: to know what you have, to get a copy, to correct it, to delete it, or to opt out of its sale or sharing.

Does it apply to you

• The relevant privacy law must apply to your organization and grant the right being exercised.
• A request arrives. It does not have to use particular words or mention a statute. An email saying delete my details can be a request.

Why it matters

Record the request promptly, identify the applicable right and determine the response deadline. Verification, permitted extensions and retention exceptions depend on the law and request type.

Requirements

• Make request channels easy to find and train staff to recognize requests received elsewhere.
• Apply the required verification process, review retention obligations and carry out the approved action across the systems in scope.
• Document how backups and downstream processors are handled.
• Under the CCPA, a request to know, delete or correct gets a confirmation within 10 business days and a response within 45 calendar days, extendable by another 45 days with notice. An opt-out of sale or sharing is honored as soon as feasibly possible and within 15 business days.
• Under the GDPR, the controller responds without undue delay and within one month of receiving the request. That can be extended by two further months for complex or numerous requests, with notice and reasons given within the first month.

Steadwatch's role

• A request form is published on your site and linked from the privacy documents, so requests arrive in a channel built to track them.
• Every request is recorded with its arrival date and the policy version that governed it, so the deadline is visible to everyone handling it.
• Approved actions on platform-held data are carried out and recorded under the agreed procedure.

Records you receive

• A request log with dates received, dates answered, and outcomes.
• An action log recording what was done with platform-held data, including deletions.

Your responsibilities

• Requests about data held outside the website: your CRM, your mailing list, your accounting system.
• Deciding whether an exemption applies to a particular request. Several statutes allow refusal in defined circumstances, and that is a legal judgment.