Data Subject Request Handling Procedure
Respond to access and deletion requests consistently.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Write a procedure for handling requests from individuals about their personal data. Types of requests we receive: [REQUEST_TYPES]. Systems where data is stored: [SYSTEMS]. Team handling requests: [TEAM]. Cover intake, identity verification proportionate to the request, logging, search across systems, redaction of other people's data, review for exemptions (to be decided with legal advice), response drafting, and closing. Provide a flowchart in numbered steps, a tracking sheet template, time targets expressed as placeholders to confirm for [JURISDICTION] ([VERIFY]), response templates for acknowledgement, extension, and refusal explaining reasons, and a checklist for deletion requests that includes backups and processors. Add quality checks and a monthly report. This is not legal advice. Add a one-page guide for staff who might receive a request by accident, such as someone in customer service, explaining what to do within one working day. Include a checklist of search locations such as email, shared drives, CRM, and backup systems, and a decision log template recording any exemptions applied and who approved them. Add a worked example of one access request from intake to closure with invented details: day 0 receipt and logging, day 1 identity check and acknowledgement, days 2 to 10 search across five systems, day 11 redaction review of third-party data, day 12 legal check of exemptions, day 13 response drafted and sent. Show the tracking sheet row at each stage. Add search guidance for the places most often missed (shared mailboxes, chat history, backups, paper files, vendor systems), a redaction checklist, and a rule for when to ask the requester to clarify scope. Provide a quality review of five checks before sending and a monthly report with volume, average time, and the share answered within the time target I set. Deadlines remain placeholders for counsel to confirm. Treat this as blue-team work. Skip exploit details and attacker playbooks, and focus on controls, evidence and fixes I can verify.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.