Data Subject Rights
GDPR establishes the following rights that data subjects can exercise:| Right | Article | Description | Response Deadline |
|---|---|---|---|
| Right of Access | Art. 15 | Obtain a copy of their personal data and information about how it is processed | 30 days |
| Right to Rectification | Art. 16 | Correct inaccurate personal data | 30 days |
| Right to Erasure | Art. 17 | Request deletion of their personal data (“right to be forgotten”) | 30 days |
| Right to Restrict Processing | Art. 18 | Limit how their data is processed | 30 days |
| Right to Data Portability | Art. 20 | Receive their data in a structured, machine-readable format | 30 days |
| Right to Object | Art. 21 | Object to processing based on legitimate interest or direct marketing | Without undue delay |
Creating a DSR
Click Create Request
Start a new DSR record when you receive a data subject request through any channel (email, web form, letter, phone).
Enter request details
Record the request type, data subject’s name and email, the date received, and any specific details about what is being requested.
Verify the requester's identity
Before responding, verify that the person making the request is who they claim to be. Record the verification method used.
DSR Workflow
Each DSR follows a structured workflow within LowerPlane:- Request Statuses
- Timeline
| Status | Description |
|---|---|
| Received | Request has been logged but not yet started |
| Identity Verification | Verifying the requester’s identity |
| In Progress | Actively working on fulfilling the request |
| Pending Review | Response prepared, awaiting internal review |
| Completed | Request has been fulfilled and response sent |
| Denied | Request was denied with documented justification |
| Extended | Deadline extended (maximum additional 2 months for complex requests) |
Handling Each Request Type
Access Requests (Article 15)
The data subject wants a copy of their personal data. You must provide:- All personal data you hold about the individual
- The purposes of processing
- Categories of data and recipients
- Retention periods
- Information about their rights
- The source of the data (if not collected directly)
Deletion Requests (Article 17)
The data subject wants their data erased. Before complying, verify whether any exemption applies:- Legal obligation to retain the data (e.g., tax records)
- Ongoing contractual necessity
- Public interest in the area of public health
- Archiving purposes in the public interest
- Establishment, exercise, or defense of legal claims
Rectification Requests (Article 16)
The data subject wants to correct inaccurate data. Update the data in all systems where it is stored and notify any third parties who received the original data.Portability Requests (Article 20)
The data subject wants their data in a machine-readable format. Provide data in a commonly used format (CSV, JSON, XML). This right only applies to data processed by automated means based on consent or contractual necessity.Deadline Management
LowerPlane tracks deadlines automatically:- Deadline calculation — The 30-day deadline is calculated from the date the request is logged.
- Reminder notifications — Owners receive reminders at configurable intervals before the deadline.
- Overdue alerts — Requests past their deadline are flagged prominently in the dashboard.
- Extension tracking — If extended, the new deadline is calculated and tracked.
Denying a Request
You may deny a DSR in limited circumstances:- The request is manifestly unfounded or excessive (e.g., repetitive requests)
- An exemption applies (legal obligation to retain data, legal claims defense)
- You cannot verify the requester’s identity
- Document the specific reason for denial.
- Inform the data subject of the denial and the reasons.
- Inform the data subject of their right to lodge a complaint with a supervisory authority.
- Record the denial in LowerPlane for audit purposes.
DSR Reporting
The DSR dashboard provides metrics for management and audit reporting:- Total requests received — Broken down by type and period
- Average response time — Mean days from receipt to completion
- Requests within SLA — Percentage completed within the 30-day deadline
- Open requests — Currently in progress with deadline countdown
- Denied requests — Count and reasons for denial
DSR as Compliance Evidence
Your DSR handling records serve as evidence for:| GDPR Article | Requirement |
|---|---|
| Articles 15-22 | Demonstrating you fulfill data subject rights |
| Article 12 | Transparent communication with data subjects |
| Article 24 | Accountability — proving compliance through documented processes |
Even if you receive zero DSRs, having a documented and operational DSR process is a compliance requirement. Auditors and supervisory authorities want to see that you have the capability to respond, not just that you have responded.