# Data Subject Request Procedure: [Organization name]

> A procedure for receiving, verifying, answering and recording requests
> from individuals who exercise their data protection rights: access,
> rectification, erasure, restriction, portability, objection and rights
> related to automated decisions. Based on the EU General Data Protection
> Regulation (Regulation (EU) 2016/679, GDPR) Articles 12 to 22 and EDPB
> Guidelines 01/2022 on the right of access (version 2.0 adopted 28 March
> 2023, current version 2.1 with minor corrections), with a variant for consumer requests under the California
> Consumer Privacy Act (Civil Code sections 1798.100 to 1798.199.100,
> CCPA) and the CCPA Regulations (effective 1 January 2026). Dates and
> rules were checked on 2026-10-30; check the current official texts
> before use. Replace every `[bracketed]` value and every row marked
> *Example*. This is a documentation format, not legal advice; check the
> current official text and a qualified professional.

<!--
Guidance: How to use this template
- Name one owner for the whole procedure (usually the privacy team or
  the data protection officer) and one handler per request. Requests get
  lost when "everyone" can answer them.
- Fill section 2 first: the list of rights and regimes that apply to you.
  Then set the intake channels (section 3) and deadlines (section 7)
  before you write the letters (section 10).
- The procedure covers the EU GDPR, the UK GDPR as a close variant and
  the CCPA as the US example. Other jurisdictions and US state laws have
  their own rules; add a column to the tables in sections 2 and 7 for
  each regime you are subject to.
- The worked example follows Quillmoor Homewares Ltd, a fictional online
  retailer established in the EU that also sells to UK and California
  customers. Every request ID, date and figure marked *Example* is
  invented.
- Related documents: Records of Processing Activities
  (`compliance/gdpr-ropa`), DPIA (`compliance/dpia`), Privacy Policy
  (`legal-lite/privacy-policy`), Data Processing Agreement
  (`legal-lite/dpa`), Data Retention and Deletion Standard
  (`data/data-retention-deletion-standard`), Privacy by Design Review
  (`compliance/privacy-by-design-review`), Personal Data Breach
  Assessment (`compliance/personal-data-breach-assessment`), Legitimate
  Interests Assessment (`compliance/legitimate-interests-assessment`).
-->

## Document control

<!-- Guidance: Record who owns the procedure and which legal regimes it covers. Questions: who signs off a refusal? Who may extend a deadline? Pitfall: a procedure with no named approver for refusals, so handlers refuse requests on their own judgement. -->

| Field | Value |
|---|---|
| Document ID | [PRIV-PROC-DSR-001] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@privacy-lead or DPO] |
| Approvers/reviewers | [@dpo], [@legal-counsel], [@ciso], [@customer-service-head] |
| Controller or business | [Legal name, establishment, registration number] |
| Regimes covered | [EU GDPR / UK GDPR / CCPA / Other] |
| Lead supervisory authority | [Authority name, if one-stop-shop applies] |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD |
| Classification | [Internal] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Data protection officer | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Legal counsel | [@name] | [Decision] | YYYY-MM-DD |
| Head of customer service | [@name] | [Decision] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved, CCPA variant added |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Updated for CCPA Regulations effective 1 January 2026 |

## Contents

1. Purpose, scope and roles
2. Rights and regimes covered
3. Intake channels and recognising a request
4. Logging and acknowledgement
5. Identity verification and authorised agents
6. Clarifying scope and searching
7. Deadlines and extensions
8. Exemptions, restrictions and refusals
9. Fulfilling each right
10. Response letters
11. Request log, records and metrics
12. Training, quality checks and review
13. Glossary and references

## 1. Purpose, scope and roles

<!-- Guidance: State who the procedure applies to and the split of duties. Questions: are we the controller (or CCPA business) for all the data in scope, or a processor (CCPA service provider) for some of it? Pitfall: answering a request for data you process on a client's behalf; as processor you forward the request to the controller and assist it. -->

This procedure makes sure that every request from an individual about
their personal data is recognised, verified, answered within the legal
time limit, and recorded, and that refusals are justified and reviewed.

It applies to all staff, contractors and processors who may receive a
request through any channel, and to all personal data held by
[Organization] as controller (GDPR) or business (CCPA).

| Role | Responsibility |
|---|---|
| Procedure owner | [@privacy-lead]: maintains the procedure, reports metrics, approves extensions |
| Data protection officer | Advises on complex cases, approves refusals and partial refusals |
| Request handler | Logs, verifies, coordinates the search, drafts the response |
| System owners | Search their systems and return results within [5] working days |
| Legal counsel | Reviews requests linked to disputes, litigation or regulators |
| Processors and service providers | Forward requests within [2] working days and assist under the contract (GDPR Art. 28(3)(e)) |
| Any employee | Forwards a request to [privacy@example.com] on the day of receipt |

## 2. Rights and regimes covered

<!-- Guidance: List the rights that apply and the article or section behind each. Questions: which regimes apply to which customers? Which rights depend on the lawful basis? Pitfall: offering portability for all data; under the GDPR it covers only data provided by the person and processed by automated means on the basis of consent or contract. -->

### 2.1 EU GDPR and UK GDPR

| Right | GDPR article | Applies when | Notes |
|---|---|---|---|
| Information on how to exercise rights | Art. 12 | Always | Concise, clear, free of charge, written or electronic |
| Access | Art. 15 | Always | Confirmation, copy of the data and the processing information in Art. 15(1)(a) to (h) and 15(2) |
| Rectification | Art. 16 | Data is inaccurate or incomplete | Includes completing data with a supplementary statement |
| Erasure | Art. 17 | One of the grounds in Art. 17(1) applies | Exceptions in Art. 17(3) |
| Restriction | Art. 18 | Accuracy contested, unlawful processing, data needed for legal claims, objection pending | Data stored but not otherwise used |
| Notification to recipients | Art. 19 | After rectification, erasure or restriction | Tell recipients unless impossible or disproportionate; tell the person who they are on request |
| Portability | Art. 20 | Consent or contract basis and automated processing | Structured, commonly used, machine-readable format |
| Objection | Art. 21 | Legitimate interests or public task basis; always for direct marketing | Direct marketing objection is absolute |
| Automated decisions | Art. 22 | Decision based solely on automated processing with legal or similarly significant effects | Human intervention, express a view, contest the decision |
| Restrictions by law | Art. 23 | Union or Member State law restricts a right | Record the specific law relied on |

The UK GDPR keeps the same article numbering. The Data (Use and Access)
Act 2025 amends the UK rules on subject access, including a statutory
basis for limiting searches to what is reasonable and proportionate and
for pausing the time limit while the controller waits for clarification.
Check on legislation.gov.uk and in the ICO guidance which of these
provisions are in force on the date you handle a request.

### 2.2 CCPA variant (California)

| Consumer right | Civil Code section | Verification required | Notes |
|---|---|---|---|
| Know (categories and specific pieces) | 1798.100, 1798.110, 1798.115 | Yes | Covers the 12 months before the request, and earlier data back to 1 January 2022 if the consumer asks and the business holds it |
| Delete | 1798.105 | Yes | Exceptions in 1798.105(d); tell service providers and contractors |
| Correct | 1798.106 | Yes | Commercially reasonable efforts |
| Opt out of sale or sharing | 1798.120 | No | Act within 15 business days (Regulations section 7026) |
| Limit use of sensitive personal information | 1798.121 | No | Act within 15 business days (Regulations section 7027) |
| No retaliation | 1798.125 | Not applicable | Do not deny goods or change prices because a right was exercised |
| Access and appeal rights for automated decisionmaking technology (ADMT) used for significant decisions | CCPA Regulations Article 11 (section 7200 and following) | Yes for access | Added by the regulations effective 1 January 2026; a business already using ADMT for significant decisions must comply by 1 January 2027 (section 7200(b)) |

Other US state privacy laws give similar rights with different deadlines
and appeal processes. List each one that applies to you in an extra
column of section 7.

## 3. Intake channels and recognising a request

<!-- Guidance: Publish clear channels but accept requests that arrive anywhere. Questions: which channels are listed in the privacy notice? How does a request sent to a sales rep reach the privacy team? Pitfall: refusing a request because it did not use the web form; the GDPR sets no format requirement and the clock starts when any official channel receives it. -->

### 3.1 Channels

| Channel | Monitored by | Hours | Forwarding rule |
|---|---|---|---|
| Web form [URL] | Privacy team | Continuous | Automatic ticket |
| Email [privacy@example.com] | Privacy team | Working days | Ticket created on receipt |
| Toll-free telephone [number] (CCPA, where required by Regulations section 7020) | Customer service | [Hours] | Call note forwarded the same day |
| Post [address] | Mailroom | Working days | Scanned and forwarded the same day |
| In-app or account settings | Product team | Continuous | Automatic ticket |
| Any other contact (social media, store, sales) | Any employee | Not applicable | Forward on the day of receipt |

Under the CCPA Regulations, a business that operates only online and has
a direct relationship with the consumer may offer an email address
alone for requests to delete, correct and know; other businesses offer
two or more methods, one of them a toll-free number, and a website
method if they have a website. If a consumer uses another method, either
treat the request as received or explain how to submit it.

### 3.2 Recognising a request

A message is a data protection request when the person asks, in any
words, to see, copy, correct, delete, move or stop using personal data
about them, or objects to how it is used. The person does not need to
name the law, use the word "request" or give reasons. When in doubt, treat
it as a request and log it.

Requests that look like data protection requests but follow other rules,
such as a request for documents in litigation or a freedom of information
request to a public body, are logged and routed to [legal counsel] for a
decision on which rules apply.

## 4. Logging and acknowledgement

<!-- Guidance: Log the request on the day it arrives, with the receipt date that starts the clock. Questions: which date counts as receipt for requests that arrive on a weekend or by post? Pitfall: logging on the date the privacy team opened the ticket instead of the date the organization received it. -->

Log every request within [1] working day of receipt with the fields in
section 11. Then send an acknowledgement (letter L1 in section 10) that
states the request received, what happens next, whether identity
information is needed, and the date by which a response is due.

| Regime | Acknowledgement rule |
|---|---|
| GDPR | Not a legal requirement; EDPB Guidelines 01/2022 recommend confirming receipt in writing and stating the period that applies |
| CCPA | Confirm receipt and explain how the request will be processed within 10 business days of receipt for requests to delete, correct and know (Regulations section 7021(a)) |

## 5. Identity verification and authorised agents

<!-- Guidance: Verify enough to avoid giving data to the wrong person, and no more. Questions: what do we already know about this person that they could confirm? Is the data sensitive? Pitfall: asking every requester for a passport copy; the EDPB treats routine ID copies as disproportionate where the person can be identified by other means, such as logging in to their account. -->

### 5.1 Verification levels

| Level | Use when | Method | Example |
|---|---|---|---|
| V0 | Request comes from an authenticated account session | Rely on the session | Customer signed in and used the privacy dashboard |
| V1 | Low-risk data, request from a known contact point | Match two data points already held | Email address on file plus last order number |
| V2 | Specific pieces of data, sensitive data, or harmful if disclosed to the wrong person | Match three data points already held, plus a signed declaration for CCPA specific pieces | Address, phone number, recent payment amount |
| V3 | Account takeover suspected, or no data held to match | Escalate to the DPO for a proportionate method | Out-of-band call to the number on file |

GDPR rule: ask for additional information only where you have reasonable
doubts about the requester's identity (Art. 12(6)), and only what is
necessary. Where you cannot identify the person at all, explain that
(Art. 11(2) and 12(2)). According to the EDPB guidelines, the time limit
may be suspended while you wait for identity information you asked for
without undue delay.

CCPA rule: match identifying information to data already held before
asking for more; a reasonable degree of certainty for categories, a
reasonably high degree of certainty for specific pieces, which may
include three data points and a signed declaration under penalty of
perjury (Regulations sections 7060 to 7062). The 45-day period runs from
receipt whatever time verification takes. Do not require verification
for opt-out of sale or sharing and for requests to limit.

### 5.2 Authorised agents and representatives

| Case | What to check |
|---|---|
| Parent or guardian for a child | Parental responsibility and the child's own interests, considering the child's maturity |
| Lawyer or representative under the GDPR | Written authority from the data subject, and identity of the data subject where reasonable doubt exists |
| CCPA authorised agent | Signed permission from the consumer; you may also ask the consumer to verify their own identity or confirm the permission directly (Regulations section 7063) |
| Third-party request platforms | Treat as an agent: confirm the mandate, never ignore the request |

## 6. Clarifying scope and searching

<!-- Guidance: Find all the data, then decide what to disclose. Questions: which systems hold data about this person (use the ROPA)? Are there unstructured sources such as email and chat? Pitfall: searching only the CRM. An access request covers all personal data, including logs, recordings, notes and data held by processors. -->

### 6.1 Clarifying the request

Ask the requester to specify the information or processing their request
relates to only when you process a large quantity of information about
them (GDPR Recital 63), and do not use clarification to delay or narrow a
request the person did not want narrowed. Without a reply, answer the
request as made.

### 6.2 Search plan

| System or source | ROPA reference | Owner | Search key | Includes processors | Done |
|---|---|---|---|---|---|
| CRM *(Example)* | ROPA-04 | [@crm-owner] | Customer ID, email | No | [Yes / No] |
| Order and payment database *(Example)* | ROPA-02 | [@commerce-owner] | Customer ID | Payment processor | [Yes / No] |
| Customer service tickets and call recordings *(Example)* | ROPA-07 | [@cx-owner] | Email, phone | Helpdesk SaaS | [Yes / No] |
| Marketing platform *(Example)* | ROPA-09 | [@marketing-owner] | Email | Email service provider | [Yes / No] |
| Email and chat archives *(Example)* | ROPA-12 | [@it-owner] | Name, email | No | [Yes / No] |
| Backups | ROPA-all | [@it-owner] | Only if data no longer exists in live systems and restoration is reasonable | No | [Yes / No] |
| [Source] | [ROPA-NN] | [@owner] | [Key] | [Processor] | [Yes / No] |

Freeze the data at the time of the search where possible: do not delete
or change data because a request has arrived, and do not delay routine
deletion only to avoid answering. Note the search date in the log.

## 7. Deadlines and extensions

<!-- Guidance: Compute the due date on the day of receipt and put it in the acknowledgement. Questions: what happens when the due date falls on a weekend? When may we extend? Pitfall: extending by default; the EDPB treats extension as an exception, and a high share of extended requests suggests the procedure needs more capacity. -->

### 7.1 Rules

| Regime | First deadline | Extension | Conditions for extension |
|---|---|---|---|
| GDPR Art. 12(3) | Without undue delay and within one month of receipt | Up to two further months | Necessary because of complexity and number of requests; tell the person within the first month, with reasons |
| GDPR Art. 12(4) (no action taken) | Without delay and within one month of receipt | None | Explain the reasons and the right to complain to a supervisory authority and to seek a judicial remedy |
| CCPA delete, correct, know (Regulations section 7021) | Confirm within 10 business days; respond within 45 calendar days of receipt | Up to 45 more calendar days, 90 in total | Reasonably necessary; notice to the consumer within the first 45 days explaining the reason |
| CCPA opt out of sale or sharing, limit | As soon as feasibly possible, at most 15 business days from receipt | None | Not applicable |

How to count a GDPR month, following EDPB Guidelines 01/2022 and
Regulation (EEC, Euratom) No 1182/71: the period ends on the same date in
the following month; where that date does not exist, on the last day of
that month; where the last day falls on a weekend or public holiday, on
the next working day.

### 7.2 Worked due dates

| Request ID | Regime | Received | Day of week | Due date | Extended due date | Reasoning |
|---|---|---|---|---|---|---|
| DSR-2026-0012 *(Example)* | GDPR access | 2026-01-31 | Saturday | 2026-03-02 | Not extended | One month gives 2026-02-28, a Saturday, so the next working day applies |
| DSR-2026-0027 *(Example)* | GDPR erasure | 2026-02-10 | Tuesday | 2026-03-10 | 2026-05-11 | Extension notice sent 2026-03-04; three months gives 2026-05-10, a Sunday |
| DSR-2026-0035 *(Example)* | CCPA know | 2026-03-02 | Monday | Confirm by 2026-03-13, respond by 2026-04-15 | 2026-05-30 at most | Counting the day of receipt as day 1 for both periods, a conservative reading; 2026-05-30 is a Saturday, so plan to answer by Friday 2026-05-29 |
| DSR-2026-0038 *(Example)* | CCPA opt-out | 2026-03-04 | Wednesday | 2026-03-24 | Not applicable | 15 business days counting the day of receipt as day 1, no California state holiday in the period |

Set internal milestones: search complete by day [10], draft response by
day [20], DPO review by day [25] of the one-month period.

## 8. Exemptions, restrictions and refusals

<!-- Guidance: Apply exemptions item by item, never to a whole request by default, and record why. Questions: would disclosure reveal another person's data? Is a statutory exception available for erasure? Pitfall: refusing a request as "excessive" because it is large or comes from a disgruntled customer; the controller must show that the request is manifestly unfounded or excessive. -->

### 8.1 Grounds to consider

| Ground | Source | Effect | Approval needed |
|---|---|---|---|
| Manifestly unfounded or excessive request | GDPR Art. 12(5) | Charge a reasonable fee based on administrative costs, or refuse; the burden of proof is on the controller | DPO |
| Rights and freedoms of others | GDPR Art. 15(4), Recital 63 | Redact third-party data or trade secrets; do not refuse the whole copy | Handler, DPO for disputes |
| Erasure exceptions | GDPR Art. 17(3)(a) to (e) | Keep data needed for freedom of expression, legal obligations or public tasks, public health, archiving or research, or legal claims | DPO |
| Restrictions in national law | GDPR Art. 23 and national implementing law | Apply only the restriction the law provides, for its purpose | Legal counsel |
| Unable to identify the person | GDPR Art. 11(2), 12(2) | Explain and invite more information | Handler |
| CCPA deletion exceptions | Civil Code 1798.105(d) | Keep data needed for the listed purposes, such as completing a transaction, security, legal obligations | Legal counsel |
| CCPA data that must not be disclosed | Regulations section 7024(d) | Never disclose government ID numbers, financial account numbers, passwords, security questions or biometric data; say that you hold them | Handler |
| CCPA unverifiable request | Regulations sections 7022 to 7024 | Deny the specific pieces, then treat a request to know as a request for categories where possible | Handler |

### 8.2 Refusal record

| Request ID | Ground | Scope refused | Evidence | Decision by | Person told of complaint route |
|---|---|---|---|---|---|
| DSR-2026-0044 *(Example)* | Art. 12(5) excessive: the same access request sent weekly for 6 weeks with no change in processing | Repeat copies only; first copy provided | Ticket history | [@dpo] | Yes, letter L5 |
| [DSR-ID] | [Ground] | [Scope] | [Evidence] | [@name] | [Yes / No] |

## 9. Fulfilling each right

<!-- Guidance: Use a checklist per right so every response contains what the law requires. Questions: does the access response include the processing information and not only the data? Have processors and recipients been told about an erasure? Pitfall: sending a raw database export that the person cannot read. -->

### 9.1 Access (GDPR Art. 15)

- [ ] Confirm whether personal data about the person is processed.
- [ ] Provide a copy of the personal data, in a commonly used electronic
      form if the request was electronic, unless the person asked
      otherwise (Art. 15(3)).
- [ ] Provide the processing information: purposes; categories of data;
      recipients or categories of recipients; retention period or
      criteria; the rights to rectification, erasure, restriction and
      objection; the right to complain to a supervisory authority; the
      source where data was not collected from the person; and the
      existence of automated decision-making with meaningful information
      about the logic and consequences (Art. 15(1)(a) to (h)).
- [ ] Describe safeguards for transfers to third countries (Art. 15(2)).
- [ ] Redact third-party data where Art. 15(4) applies and record why.
- [ ] Explain codes and abbreviations so the copy is intelligible.
- [ ] Send through a secure channel; protect files with a password sent
      separately.

### 9.2 Rectification, erasure and restriction (Art. 16 to 19)

- [ ] Check the ground or accuracy claim; for disputed accuracy, restrict
      processing while checking (Art. 18(1)(a)).
- [ ] Correct, erase or restrict in every system in the search plan,
      including processors.
- [ ] For erasure of data made public, take reasonable steps to inform
      other controllers processing it (Art. 17(2)).
- [ ] Notify recipients under Art. 19 unless impossible or
      disproportionate; tell the person who they are if asked.
- [ ] Keep a minimal suppression record (for example a hashed email) where
      needed to honour the request in future, and say so in the response.
- [ ] Backups: record when the data will age out of backups and that it
      will not be restored into live use.

### 9.3 Portability (Art. 20)

- [ ] Confirm the basis is consent or contract and processing is
      automated.
- [ ] Export data the person provided, including observed data such as
      activity logs, in a structured, machine-readable format such as
      JSON or CSV.
- [ ] Transmit directly to another controller where technically feasible
      and requested.

### 9.4 Objection and automated decisions (Art. 21 and 22)

- [ ] Direct marketing objection: stop at once, across all channels.
- [ ] Other objections: stop unless compelling legitimate grounds that
      override the person's interests exist, or the data is needed for
      legal claims; document the balancing (link the legitimate interests
      assessment).
- [ ] Automated decisions: offer human review by a person with authority
      to change the outcome, let the person give their view, and record
      the result.

### 9.5 CCPA requests

- [ ] Know: disclose categories or specific pieces for the period
      required, in a portable and readily usable format for specific
      pieces; never disclose the data listed in Regulations section
      7024(d).
- [ ] Delete: delete from live systems, deidentify or aggregate; tell
      service providers, contractors and, where relevant, third parties
      to whom data was sold or shared; record any exception relied on.
- [ ] Correct: consider the totality of the information, document the
      decision, and tell the consumer whether the correction was made.
- [ ] Opt-out and limit: act within 15 business days and honour
      opt-out preference signals as the regulations require.
- [ ] Explain the right to complain and any appeal process you offer.

## 10. Response letters

<!-- Guidance: Keep letters short and plain. Each letter must say what was decided, why, and what the person can do next. Pitfall: legalistic letters that bury the answer. -->

| Letter | When | Must contain |
|---|---|---|
| L1 Acknowledgement | Within [3] working days (CCPA: 10 business days) | Request ID, received date, due date, verification step if any |
| L2 Identity information needed | Reasonable doubt about identity | What is needed, why, how it will be used and deleted |
| L3 Extension notice | Before the first deadline | Reasons, new due date |
| L4 Response | On fulfilment | Action taken per right, the data or a link, the information required by section 9 |
| L5 Refusal or partial refusal | When any part is refused | Reasons, the right to complain to a supervisory authority and to seek a judicial remedy (GDPR Art. 12(4)), or the CCPA complaint route |

*Example* L3 extension notice:

> Dear [Name],
>
> We received your request to delete your personal data on 10 February
> 2026 (reference DSR-2026-0027). Your account is linked to orders,
> warranty records and marketplace accounts held in four separate
> systems, and two of our service providers hold copies. We need more
> time to complete the deletion safely, so we are extending the deadline
> as the GDPR allows (Article 12(3)). You will receive our answer by
> 11 May 2026 at the latest, and sooner if we can.
>
> If you are not satisfied with how we handle your request, you can
> contact our data protection officer at [contact], complain to
> [supervisory authority] or seek a judicial remedy.
>
> [Name], Privacy team, Quillmoor Homewares Ltd

## 11. Request log, records and metrics

<!-- Guidance: The log proves compliance. Questions: can we show for every request when it arrived, what we did and when? Pitfall: keeping copies of the disclosed data in the log; keep the record of the response, not a second copy of everything. -->

### 11.1 Log fields

| Field | Content |
|---|---|
| Request ID | DSR-YYYY-NNNN |
| Received date and channel | Date that starts the clock |
| Regime | GDPR, UK GDPR, CCPA, other |
| Rights requested | Access, erasure and others |
| Verification level and date verified | V0 to V3 |
| Due date and extended due date | Computed under section 7 |
| Systems searched | From the search plan |
| Outcome | Fulfilled, partially fulfilled, refused, withdrawn |
| Exemptions applied | Ground and approver |
| Response date | Date sent |
| Handler | [@name] |

Retain the log for [period]; the CCPA Regulations require records of
requests and responses for at least 24 months (section 7101). Businesses
that handle the personal information of 10,000,000 or more consumers in
a calendar year also compile and disclose yearly request metrics
(section 7102).

### 11.2 Metrics

| Metric | Q1 2026 *(Example)* | Target |
|---|---|---|
| Requests received | 184 (access 92, erasure 51, rectification 14, objection or opt-out 19, portability 8) | Not applicable |
| Closed within the legal deadline | 171 of 184 (92.9%) | 100% |
| Extended | 7 of 184 (3.8%) | Under [5%] |
| Refused in whole or in part | [n] | Reviewed by DPO |
| Median days to close | [n] | Under [15] |
| Complaints to a supervisory authority | [n] | 0 |

## 12. Training, quality checks and review

<!-- Guidance: Make sure frontline staff recognise requests and that responses are checked. Questions: who samples closed requests? What triggers a procedure update? Pitfall: training only the privacy team, while most requests arrive through customer service. -->

- Train customer-facing staff at onboarding and yearly to recognise and
  forward requests.
- The DPO samples [10%] of closed requests each quarter for completeness,
  timeliness, redaction quality and tone, and records findings.
- Review the procedure yearly, after a complaint or regulator inquiry,
  after a significant system change, and when a law, regulation or EDPB
  or ICO guidance changes.
- Report metrics and sample findings to the management review.

## 13. Glossary and references

<!-- Guidance: Define terms and list the exact texts consulted with their dates. -->

### 13.1 Glossary

| Term | Meaning in this document |
|---|---|
| Data subject | The identified or identifiable living person the data relates to (GDPR) |
| Consumer | A natural person who is a California resident (CCPA) |
| Controller | The body that decides the purposes and means of processing (GDPR) |
| Business | The CCPA term for the entity that determines purposes and means and meets the CCPA thresholds |
| Processor, service provider, contractor | Bodies that process data on behalf of the controller or business |
| DSAR | Data subject access request, often used for any rights request |
| Verifiable consumer request | A CCPA request the business can verify under the regulations |

### 13.2 References

| Reference | Version or date | Use |
|---|---|---|
| Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016 | Applies from 25 May 2018; check the consolidated text and any pending amendments | Articles 11, 12 to 23, 28 |
| EDPB Guidelines 01/2022 on data subject rights, right of access | Version 2.1 (version 2.0 adopted 28 March 2023, minor corrections 30 May 2024) | Receipt, identity, time limits, format |
| Regulation (EEC, Euratom) No 1182/71 on periods, dates and time limits | 3 June 1971 | Counting months |
| California Civil Code sections 1798.100 to 1798.199.100 (CCPA as amended by the CPRA) | Check the current text on leginfo.legislature.ca.gov | Consumer rights and timing |
| CCPA Regulations, California Code of Regulations Title 11, Division 6, Chapter 1 | Effective 1 January 2026 | Sections 7020 to 7027, 7060 to 7063, 7101, 7102 |
| UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 | Check commencement on legislation.gov.uk | UK variant |
| ICO guidance on the right of access | Updated 8 December 2025 | UK variant |

## Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR) as published in the Official
Journal of the European Union, EDPB Guidelines 01/2022 version 2.1, the
California Consumer Privacy Act (Civil Code section 1798.100 and
following) and the CCPA Regulations effective 1 January 2026. Articles,
sections and time limits are cited and summarised in original wording;
no legal text is reproduced beyond short references. Laws, regulations
and guidance change: check the current official texts at
https://eur-lex.europa.eu/eli/reg/2016/679/oj,
https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en,
https://leginfo.legislature.ca.gov and https://cppa.ca.gov/regulations/
before use. This is a documentation format, not legal advice; check the
current official text and a qualified professional. Template licence:
MIT.