Evidence
A data subject rights process, not a mailbox
Rights requests arrive by whatever channel the person happens to use, and the deadline starts then — not when it reaches the right team.
Published: Facts checked:
What does a data subject rights process need?
A defined intake covering every channel a request might arrive on, including support tickets and social media; identity verification proportionate to the request; an owner; and a tracked clock. Then the hard part: actually locating one person’s data across every system, which is where the records of processing earn their cost.
And a record of the outcome. A request handled well with nothing showing it was handled is indistinguishable, to a regulator or an auditor, from one ignored.
The bottom line
Rehearse one request end to end before you receive a real one. The rehearsal is where you find out how long finding the data takes.
Related services
ISO/IEC 27701 — Privacy Information Management
Turn privacy from a policy document into a management system, with the records a regulator or an enterprise buyer will ask to see.
GDPR Compliance
Work out whether the GDPR reaches you directly or by contract, then build the records, processes and transfer answers either route demands.
DPDP Act Compliance for Indian Companies
Be ready for the duties the Digital Personal Data Protection Act places on you from 13 May 2027 — starting with knowing where personal data actually lives.
Related insights
Evidence
Running an internal audit that is worth the day it costs
Its job is to find things before the external auditor does, not to pass.
Evidence
Corrective action is not the same as fixing it
A fix addresses the instance. Corrective action addresses why it happened.
Evidence
Evidence that collects itself
If producing evidence is a separate task, it will be skipped in a busy quarter.
