Knowledge base

Responding to a data subject request

What happens when a request arrives, within what period, and what to watch for.

When to use it: When someone asks for information about, correction of, or deletion of their data.

Steps

01
Record the request
The date received, the channel and the content are recorded. The clock starts from this date; a request lost in an inbox is the most common failure.
02
Verify identity
Make sure the request really belongs to the data subject. Answering without verification can mean disclosing data to an unauthorised person.
03
Classify the request
Is it a request for information, rectification, deletion, or notification of recipients? Identify which of the rights in article 11 it falls under.
04
Find the data
This is where the inventory earns its place: which systems hold data about this person. Without one, this step takes days.
05
Prepare the response
If the request is met, state what was done; if not, state the reason. An unreasoned refusal reads against you in a complaint.
06
Respond within the period
Under the Communiqué the application is concluded within thirty days at the latest. Set up a mechanism that counts the days.
07
Keep the record
The request, the action taken and the response are stored together. This is what you show in an audit.

The guides describe general practice and are not legal advice. Refer to the official source for the current text of the legislation.

The free initial assessment maps your current state and tells you which step should come first. You are not committed to anything afterwards.

Look at it yourself first

A twenty-five question KVKK compliance test with per-area scores and a priority recommendation. No sign-up.

Let's look together

We discuss your current state and work out which step comes first and how long it takes.