data-subject-request-procedure
Use this to build the procedure once and to rehearse it before a real request arrives. You get four files in a new folder, ./data-subject-request-procedure/: the written procedure staff follow when someone asks for their data (procedure.md); a table of every system holding personal data, with how to search, export and delete in each (system-search-map.md); plain-language reply letters, one per type of request (response-templates.md); and an empty spreadsheet you can open in Excel to log each request and its deadline (request-log-template.csv). This skill drafts for a human to review and sign; this skill never marks a control effective. The privacy lead approves the procedure and every response before it is sent.
Inputs to gather
Read the record of processing activities, system and vendor lists, data processing agreements, the privacy notice, support tooling and past requests. Ask the reader, in one message: who is the privacy contact or data protection officer, which channels customers and staff use to reach the company, whether the company also processes data for customers (then requests about that data belong to the customer), and which countries' supervisory authorities matter.
Step 1: design intake
A request is valid whatever the channel or wording: an email to any employee, a support ticket, a chat message, a letter. The procedure says:
- Every front-line role forwards anything that looks like a privacy request to one queue within one business day, with the original message and the date it arrived. The deadline runs from receipt by the company, not from arrival in the queue.
- A web form may be offered, never required.
- If the company is the processor for the data concerned, it forwards the request to the customer as the data processing agreement sets out (the assistance term in Article 28(3)(e)) and does not answer it.
Step 2: verify identity proportionately
Use what the company already trusts: a request from the account's email address or the logged-in product is usually enough. Ask for more only where there are reasonable doubts (Article 12(6) of the GDPR) and ask for the least that resolves them. Do not demand a copy of an identity document by default; it collects more data than the request needs. Requests made through an agent or lawyer need evidence of their authority. Record what was checked and the dates: ask promptly, never use verification to buy time, and follow the supervisory authority's guidance on how the clock runs while you wait.