How do you respond to an access request?

Required tools

• Overview of systems containing personal data — Without it, every request becomes a small project.

Receive and verify

1. 1.Record the request with the date

   The deadline runs from the date it was received. Register it as a case so that it does not remain in an inbox while the person responsible is on holiday.

2. 2.Confirm who is asking

   Do not disclose information to the wrong person. Use a known communication channel rather than routinely asking for a copy of their ID.

3. 3.Clarify what they want

   Many people really just want to know one thing—why they are receiving emails from you. A quick clarifying question often saves both parties a lot of work.

Collect and submit

1. 4.Review the system list

   CRM, email, marketing tools, case management and support systems. Check them off. Without a list, something is always forgotten.

2. 5.Remove other people's information

   An email thread may contain information about other individuals. This information must be redacted before disclosure.

3. 6.Write the answer in plain language

   What information you have, where it came from, what it is used for, and how long it is retained. A raw export is not an answer.

4. 7.Record what was dispensed

   If a complaint is submitted, you must be able to show what you sent and when.