Fiche 40/54 Part 4 — Data Subject Rights Intermediate Reviewed 2026-08-23

Operational Workflow: Subject Rights Requests Management

Handling data subject rights requests requires a standardized operational procedure: central intake, request qualification, proportionate identity verification, substantive execution within the one-mo

Open in interactive reader

🧪 Operational Workflow ⚖️ Accountability & Timelines

Operational Workflow: Subject Rights Requests

⚡ In 30 seconds

A compliant rights management procedure follows five chronological phases: 1. Central Intake & Logging → 2. Qualification & ID Check → 3. Technical Extraction / Execution → 4. Secure Communication within 1 Month → 5. Archiving in the Rights Register.

Workflow Phase	Key Operational Tasks	Target Completion Timeline
Phase 1: Intake	Log request into central ticketing; record reception timestamp; send auto-acknowledgment.	Day 1 to 2
Phase 2: Qualification	Identify exact right (access, erasure...); verify identity if reasonable doubt exists.	Day 3 to 7
Phase 3: Execution	Retrieve records from databases; redact third-party data; prepare export package.	Day 8 to 20
Phase 4: Response	Provide secure response via authenticated portal or encrypted email transmission.	Before Day 30
Phase 5: Accountability	Log closure date, legal reasoning in case of refusal, and preserve proof for DPA audits.	Upon delivery

⚡ Key Takeaways

Deadline clock starts ticking upon receipt of the request, not upon internal assignment.
Sub-processors must be contractually bound to assist in responding within defined SLAs.
The internal register of requests is inspectable evidence during regulatory audits.

⚠️ Common Pitfall

Treating a request as non-existent because the user did not use the organization's official proprietary web form.

🛠️ In Practice

Maintain a dedicated `privacy@` or `dpo@` email routing inbox connected directly to the compliance ticketing queue.

⚖️ Official Sources: Articles 12, 15 to 22 GDPR · EDPB Guidelines 01/2022 on Data Subject Rights ✓ Legal review: 23 August 2026