Collect records for data subject requests
When a person asks for their data, the system logs the request, verifies who is asking, searches the systems you list, gathers the matching records and prepares a package with redactions marked for review. Privacy staff decide what is released. For teams that run these requests by spreadsheet and deadline panic.
Function: Legal and compliance · Industry: Any industry
Collect records for data subject requests
6 steps
At a glance
- Trigger
- A data subject access or deletion request arrives.
- Typical inputs
- Request messages and forms
- Identity verification evidence
- Data map listing systems that hold personal data
- Retention and exemption rules
- Systems it usually connects to
- Gmail
- Zendesk
- Salesforce
- Google Drive
- How the work splits
3 rules, 1 model, 2 person steps
How it runs, step by step
6 steps, each tagged by what does the work. Rules are fixed logic, a model reads or drafts, and a person decides.
- Rules Fixed logic in code
- Model AI reads or drafts, with a confidence score
- Person A named person decides
- 1
Log the request and the clock
RulesThe request is recorded with its type and the response deadline for the relevant law.
- 2
Verify the requester
PersonPrivacy staff confirm the person's identity by the method your procedure sets.
- 3
Search the listed systems
RulesThe identifiers are searched across the systems in your data map, using read-only access, and the hits are collected.
- 4
Flag third-party and sensitive content
ModelA model marks passages that mention other people or privileged information as candidates for redaction.
- 5
Decide what is released
PersonA privacy officer reviews redactions and exemptions, and decides what the response includes.
- 6
Deliver and record
RulesThe package is sent securely, the deadline is closed and the case file stored.
Where people approve
The decisions that stay with your team, whatever the confidence score says.
- The privacy officer approves every release.
- Legal decides on exemptions and refusals.
- Deletion requests are executed only after confirmation of what is exempt.
KPIs to track
What to measure, before and after. Targets come from your own baseline.
- 01Days from request to response, against the deadline
- 02Requests answered inside the legal deadline
- 03Staff hours per request
- 04Systems searched versus the data map
Questions about this workflow
Does it know which law applies?
It applies the deadlines and rules your privacy team configured for each region. Deciding which law covers a requester is a legal call, and we do not automate that.
Can it delete data on its own?
Deletion runs only as an approved step, per system, and after a person confirms the retention and exemption checks. We prefer a verified, logged deletion to a fast one.
Which steps use rules, a model and a person?
Rules: log the request and the clock; search the listed systems; deliver and record. Model: flag third-party and sensitive content. Person: verify the requester; decide what is released. Rules are fixed logic in code. A model reads or drafts and reports its confidence. A named person decides.
What do we need to start?
Typically: request messages and forms; identity verification evidence; data map listing systems that hold personal data; retention and exemption rules. You also need read access to Gmail, Zendesk, Salesforce and Google Drive, or the equivalents you use. A workflow audit measures your volumes and past cases first, then gives a fixed price for the build, so you can decide with real numbers.