Loading patterns…
Process CCPA, GDPR, and other data subject access requests (DSARs) within legally mandated timeframes. Manage intake, identity verification, data collection, review, and response.
Rendering diagram…
Use a regulatory data request handler when:
| Phase | SLA | Key Activities |
|---|---|---|
| 1. Intake | Day 0 | Receive request, log it, assign ID |
| 2. Verify Identity | Day 1–5 | Confirm the requestor is who they claim to be |
| 3. Classify | Day 3–7 | Determine request type and scope |
| 4. Collect Data | Day 7–25 | Gather data from all systems where the subject's data exists |
| 5. Review | Day 25–35 | Legal/privacy team reviews response for completeness |
| 6. Respond | Day 35–45 | Deliver response to the data subject |
| 7. Close | Day 45 | Archive the request with full documentation |
Create a multi-channel intake system:
| Channel | Implementation |
|---|---|
| Web form | Self-service form on your privacy page |
| Dedicated mailbox ([email protected]) | |
| Phone | Agent creates request in the system |
| In-person | Agent creates request in the system |
Each request gets:
Before disclosing or deleting any data, verify the requestor's identity:
| Verification Method | When to Use |
|---|---|
| Email verification | They have a known account |
| Government ID | High-risk requests (deletion) |
| Account security questions | They're a known customer |
| Notarised affidavit | Agent/authorised representative requests |
If identity cannot be verified within 5 days, respond requesting additional verification. The SLA may be paused in some jurisdictions during verification.
| Request Type | Action Required | Complexity |
|---|---|---|
| Right to Know | Compile all personal data held | High — search all systems |
| Right to Delete | Delete from all systems (with exceptions) | High — coordinate across teams |
| Right to Correct | Update specified inaccurate data | Medium — locate and update |
| Right to Opt-Out | Remove from marketing/selling lists | Low — flag in systems |
| Right to Portability | Export in machine-readable format | Medium — structured export |
Create a task for each system that holds the subject's data:
| System | Team | Data Held | Task |
|---|---|---|---|
| CRM | Sales Ops | Contact info, interaction history | Export records, screenshot of profile |
| Marketing platform | Marketing | Email lists, campaign engagement | Export subscriber data |
| HR system | HR | Employee data (if applicable) | Export employee record |
| Support system | Support | Tickets, chat transcripts | Export case history |
| Analytics | Data team | Behavioral data, cookies | Export/delete tracking data |
| Backups | IT | All of the above (archived) | Note: backup deletion may be deferred |
Use Fan-Out / Fan-In to assign all collection tasks in parallel, then wait for all teams to respond.
Before responding to the data subject:
| Response Type | Delivery Method |
|---|---|
| Data package | Secure download link (encrypted, time-limited) |
| Deletion confirmation | Email with specifics of what was deleted |
| Correction confirmation | Email confirming the updates made |
| Partial denial | Email explaining the exemption with legal basis |
Store the complete case file:
Never miss a DSAR deadline. GDPR fines can reach €20 million or 4% of global revenue. Use the Escalation with SLA Timeout pattern aggressively — escalate at 50%, 75%, and 90% of the deadline.
Periodically review who has access to what, confirm it's still needed, and revoke what isn't. Kills the slow-drip accumulation of stale permissions that turn into audit findings.
Record every significant action to an append-only log that can be inspected but not altered. Essential for compliance, incident response, and answering 'who changed this and when?'
Externalize complex branching logic — pricing tiers, eligibility rules, routing decisions — into a readable table that business users can maintain without a developer in the loop.