Triage by requested outcome, then review the weekly queue
Use this page for ongoing operations across different rights. The DSAR management guide covers the access-request sequence; the software guide covers buying decisions. A single request can need several workstreams.
- At weekly review, identify unassigned work, overdue internal actions, waiting evidence and uncertain target dates.
- Record a next action, named owner and next review date for each open stream. Do not mark the whole request complete because one task finished.
| Requested outcome | Work to coordinate | Record before completion |
|---|---|---|
| Access or portability | Locate records; review disclosure and usable format | Approved response and delivery evidence |
| Deletion | Review grounds and exceptions; assign changes in source systems | Source-specific outcome, retained records and rationale |
| Correction | Locate disputed values and authorize the change | What changed, where and what remains disputed |
| Opt-out or restriction | Identify the relevant processing and responsible system owner | Which use was stopped or restricted and any limitation |
Create one front door
A hosted portal gives requesters a consistent place to submit requests and gives the response team a clear record to start from. This reduces handoff confusion and makes every request easier to find.
- Collect request type, contact details, relationship context, and notes.
- Avoid asking requesters to choose legal conclusions.
- Send confirmation so the requester has a reference point.
Make ownership visible
Privacy requests stall when ownership is implicit. Every case should show the responsible owner, the current status, and the next action required from the team.
- Use filters for unassigned, blocked, due soon, and overdue cases.
- Record pauses and exceptions with rationale.
- Keep team tasks tied to the case rather than separate threads.
Close with a record
A closed request should leave behind a clear operational history. The team should not need to reconstruct the process from email, chat, and memory.
- Capture verification, assignment, review, delivery, and closure events.
- Keep response files controlled through expiration and revocation.
- Export or review the case record when the company needs to check how a request was handled.
Example: support receives a request for account data
Support records the original message and assigns a case owner. The owner confirms the scope, arranges verification, and asks the product and support teams to gather relevant records. One reviewer checks the response before delivery.
- Keep the original wording so a handoff does not silently narrow the request.
- Give each contributor a defined task and a clear place to record the result.
- Ask the case owner to reconcile missing results before the final review.
Use a short recurring case review
A regular review should end with named actions, not another list of statuses. Start with cases that have no owner, then look at approaching dates and work waiting on someone else.
- For each open case, name the next action and the person responsible.
- Check whether a requester reply or a completed task changes what happens next.
- Review one closed case periodically and improve the template where the team had to improvise.
Sources
Source list established September 20, 2026; new inline references checked September 24, 2026. These primary and regulator materials support the legal-rule summaries above; check the current rules that apply to your organization.
- EU General Data Protection Regulation, Articles 12 and 15 — Primary text for access rights, transparent communication, identity questions, and response timing.
- California Attorney General: California Consumer Privacy Act — Official overview of consumer rights, designated request methods, verification, and 45-calendar-day responses.
Common questions
What is privacy request management?
It is the workflow a company uses to receive, verify, fulfill, respond to, deliver, and document customer privacy requests.
Who usually owns privacy request management?
Ownership often sits with legal, compliance, operations, support, or engineering until a dedicated privacy operations team exists.
What is the biggest risk in ad hoc privacy request handling?
The biggest risk is losing context across inboxes, spreadsheets, files, and informal reminders, especially when deadlines and sensitive data are involved.
Run privacy requests in one controlled workflow
Privacy Requests helps teams manage intake, verification, tasks, response preparation, secure delivery, and audit history without a broad enterprise suite.
Start free