Data Subject Requests

What it does

Individuals have rights under Articles 15 to 22 GDPR: access, rectification, erasure, restriction, portability and objection. A request can arrive by email, by letter, through a form or in a customer-service chat, and the controller has one month to respond (Article 12(3)), which can be extended by two further months for complex or numerous requests. What the law requires is described in our practical guide to access requests.

Every request gets its own file, a deadline and a clear route to an answer. The lawyer decides whether an exception applies, what to redact and what to say.

Functions

Logging in the client portal

Your team logs a request in the client portal when it arrives, with the date of receipt, the channel, the type of right invoked and the identity of the requester. The date of receipt matters, as the one-month period runs from it.

Identity check and clarification

The record notes how the requester's identity was verified (Article 12(6) allows you to ask for additional information where there are reasonable doubts) and any clarification asked. Requests that are manifestly unfounded or excessive (Article 12(5)) are flagged for the lawyer's decision.

Deadline tracking

Each request shows the deadline and what is open. If an extension is justified, the reasons are recorded and the notice to the individual, which must be sent within the first month, is prepared for approval.

Data export for access requests

For access requests, the data held in linked records is collected into an export that the lawyer can review. The review covers what must be redacted to protect the rights of others (Article 15(4)), privileged material and information that falls outside the request. The response also has to contain the information in Article 15(1), such as purposes, recipients and retention periods, which can draw on the entry in your record of processing.

Erasure cascade

For a request under Article 17 (the right to be forgotten), we trace the individual's data across your linked records and propose erasure or anonymisation of each. Erasure is not absolute. Article 17(3) lists exceptions, including compliance with a legal obligation and the establishment, exercise or defence of legal claims, and retention periods set by other laws may require records to be kept. The lawyer decides per record, and the reasons are logged.

Response and file

The response is drafted for review and approved before it is sent. The request, the steps and the response are stored in one file, which is your evidence if the individual complains to the authority.

What you receive

• A request file with deadline, verification, decisions and response.
• A reviewed export for access and portability requests.
• A record of what was erased, what was kept and the legal reason for keeping it.
• A list of requests and their status for the DPO's periodic review.

Example walk-through

Take a Kortrijk gym chain that receives an email from a former member asking for all data and for deletion. The front desk logs it in the portal the same day; the deadline is shown. The record notes that identity was confirmed by matching the member's registered email and a membership number. The function collects the member's data from the linked records: contract, payments, access-card logs, newsletter preferences and two complaint tickets. The lawyer reviews the export, redacts the name of another member in a complaint, and decides that invoices stay for the period required by accounting law. We propose deleting or anonymising the rest, which the lawyer approves. The response, with the information required by Article 15 and an explanation of what was kept and why, goes out within the month.

The log of requests also shows patterns, such as many requests from one channel or one recurring complaint, which the DPO can raise with management as a sign of a process that needs fixing.

Where it is used

We handle these requests as part of our DPO as a Service. It also matters after a data breach, when affected individuals commonly ask what you hold about them and whether it can be deleted. See also the 72-hour rule. Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out. Our platform is hosted in the EU.