Responding when someone asks for their data.
WHAT TO DO FIRST
Log it, with the date received.
WHY
The clock starts then.
WHAT TO ESTABLISH
That the requester is who they claim.
HOW
Proportionate verification, without demanding excessive documentation.
WHY PROPORTIONATE
Excessive demands are themselves a failing, and a delaying tactic is visible.
WHAT TO CLARIFY, IF NEEDED
What they are actually looking for.
WHY
Broad requests are frequently about one thing.
WHAT NOT TO DO
Use clarification to delay.
WHERE TO SEARCH
Every system in your inventory.
WHAT PEOPLE FORGET
Support tickets Email Backups Messaging Notes about the person
WHY NOTES MATTER
Internal opinions about someone are their personal data.
WHAT TO REDACT
Other people's personal data Information genuinely exempt
WHAT TO PROVIDE
The data, plus the processing information required.
IN WHAT FORMAT
Commonly used and accessible.
WHAT TO DO IF IT IS VOLUMINOUS
Discuss scope, and provide in stages if agreed.
WHAT TO RECORD
What was searched, what was provided, and what was withheld with reasons.
WHAT TO NEVER DO
Ignore it, or respond dismissively.
