Handling DSAR requests
How to handle data subject requests (access, rectification, erasure, portability) within the terms of Art. 12 GDPR.
Request types
- Access (Art. 15) — the data subject asks what data you hold about them
- Rectification (Art. 16) — correction of inaccurate data
- Erasure (Art. 17) — right to be forgotten
- Restriction (Art. 18) — suspension of processing
- Portability (Art. 20) — export of data in a structured format
- Objection (Art. 21) — stop to processing based on legitimate interest
The deadline to respond to a DSAR is 30 days from receipt. Privacta automatically starts the countdown and notifies the assigned owner.
Handling workflow
- The request arrives in Privacta’s centralized inbox
- It is assigned automatically or manually to an owner
- The 30-day countdown starts, with alerts at 15 and 7 days
- The owner follows the guided workflow for the request type
- The response is sent and documented in the audit trail
📄 Add the full DSAR handling workflow with screenshots of the panel