Respond to a data subject request

---
name: respond-to-a-data-subject-request
category: data
description: Coordinate a verified, scoped, and privacy-safe response to an individual's data rights request. Use when access, correction, deletion, restriction, objection, or portability work crosses systems or processors.
---

# respond-to-a-data-subject-request

Produce an authorized response with a complete evidence trail. This procedure coordinates operations and does not decide which law applies.

## Inputs

- Original request, receipt channel, dates, requested rights, and stated scope
- Approved identity-verification and representative-authority process
- Systems, processors, owners, exemptions, preservation duties, and response templates
- Applicable deadline and interpretation from the authorized privacy or legal owner

## Procedure

1. Log the request, preserve its wording, calculate the approved deadline, and assign a case owner.
2. Minimize verification data and use the approved identity or agent validation path.
3. Clarify ambiguous scope without delaying work that can safely begin.
4. Build a search plan across identifiers, aliases, accounts, archives, communications, logs, processors, and derived records.
5. Track each system's search method, custodian, dates, result count, limitations, and evidence reference.
6. Separate responsive data from third-party data, privileged material, security-sensitive content, holds, and disputed exceptions.
7. Route legal or policy judgments to the authorized owner; record the decision and authority.
8. Perform approved correction, restriction, deletion, or export through controlled workflows.
9. Independently reconcile the final package or action against the search ledger.
10. Deliver securely, record delivery evidence, and retain only the case evidence required by policy.

## Guardrails

- Do not disclose account data before identity and authority checks pass.
- Do not erase evidence, legal holds, or another person's data without an approved decision.
- Treat “no results” as a search conclusion that needs scope and method evidence.
- Never promise a deadline or right that the responsible authority has not confirmed.

## Done

- Verification evidence makes identity, scope, deadline, searches, decisions, and actions traceable
- Third-party and sensitive material received an authorized review
- Reconciliation evidence shows the response was delivered through an approved channel
- Limitations, residual copies, and follow-up commitments are explicit