Handling data subject requests: a working guide

Updated

If you have just been handed the privacy request queue, this is the map: what people can ask for under the main laws, how long you have, and the steps a request goes through from the moment it lands to the moment you close it.

The process is the same whatever law applies. What changes from law to law is which rights exist, how long you have, and a handful of edge rules. So this guide starts with the matrix, then walks the process once. For the automation side, the pillar guide on data subject request automation goes deeper on each stage.

Not legal advice. Every cell below was checked against the statute or regulation linked in the source list as of October 2026, but laws in this area are amended often; check the current text before relying on a specific rule.

The rights matrix

"Yes" means the law gives the right in some form. The notes say where the form is narrower than the name suggests, which is most of the time.

LawAccessDeletionCorrectionPortabilityOpt-out of sale / sharing / targeted adsDeadline
EU GDPR Yes (Art. 15): copy of data plus purposes, recipients, retention, source Yes, conditional (Art. 17): only where a listed ground applies, such as data no longer needed or consent withdrawn Yes (Art. 16) Yes, narrow (Art. 20): data the person provided, processed by automated means on consent or contract No "sale" concept. Right to object (Art. 21), absolute for direct marketing including related profiling One month, plus two months for complex or numerous requests (Art. 12(3))
UK GDPR Yes; since the Data (Use and Access) Act 2025, limited to what a reasonable and proportionate search finds Yes, conditional (Art. 17) Yes (Art. 16) Yes, narrow (Art. 20) Right to object, absolute for direct marketing One month from the latest of receipt, ID or fee, plus two months; clock stops for needed clarification (Art. 12A, in force 5 Feb 2026)
California CCPA / CPRA Yes, "right to know" (1798.110, 1798.115) Yes, of data collected from the consumer, with exceptions (1798.105) Yes (1798.106) Partial: access responses must be in a portable, machine-readable format where technically feasible (1798.130) Yes: opt-out of sale and of "sharing" for cross-context behavioral advertising (1798.120), plus limit use of sensitive data (1798.121). Preference signals such as GPC must be honored Confirm in 10 business days; respond in 45 calendar days, plus 45 with notice. Opt-out: no later than 15 business days
Virginia VCDPA Yes (59.1-577) Yes, of data provided by or obtained about the consumer Yes Yes: data the consumer provided, where processing is automated Yes: targeted advertising, sale, and profiling with legal or similarly significant effects 45 days, plus 45 once with notice. Appeals decided within 60 days
Colorado CPA Yes (6-1-1306) Yes Yes Yes, up to twice per calendar year Yes: same three categories; universal opt-out mechanisms must be honored since July 1, 2024; agents may opt out on a consumer's behalf 45 days, plus 45 with notice. Appeals: 45 days, plus 60
Brazil LGPD Yes (Art. 18 I-II), plus information about who data was shared with Yes: of unnecessary, excessive or unlawfully processed data, and of data processed on consent Yes, of incomplete, inaccurate or outdated data Yes, subject to ANPD regulation; excludes anonymized data No sale opt-out. Consent can be revoked, and processing can be opposed where the law is not being followed (Art. 18 ยง2) Access: simplified reply immediately, or full statement within 15 days (Art. 19). Other rights: no fixed statutory deadline
Quebec Law 25 (private sector act) Yes (s. 27) Indirect: rectification where keeping the data is not authorized by law (s. 28), deletion of obsolete or unjustified data under Civil Code art. 40, and de-indexation or cessation of dissemination (s. 28.1) Yes (s. 28) Yes, since September 22, 2024: data collected from the person, in a structured, commonly used technological format, unless that raises serious practical difficulties No sale opt-out 30 days for access and rectification; silence counts as refusal (s. 32)

The rest of the United States

Twenty-one states have now enacted comprehensive consumer privacy laws. Indiana, Kentucky and Rhode Island took effect on January 1, 2026. Two more were signed in 2026 and are not yet in force: Oklahoma's (SB 546, signed March 20, 2026) takes effect January 1, 2027, and Alabama's Personal Data Protection Act (HB 351, signed in April 2026) takes effect May 1, 2027. Most follow the Virginia template: access, deletion, correction, portability and the three opt-outs, a 45-day response window with one 45-day extension, and a mandatory appeal process. The variations that matter operationally are appeal deadlines, whether universal opt-out signals are mandatory, whether authorized agents are allowed for anything beyond opt-outs, and how employee and B2B data are treated (California is the outlier in covering both). Track them in a single table keyed by state, and expect it to change every legislative session. State-specific guides: Utah, California's CPRA and the 2026 regulations.

Step 1: receive and log

The clock starts when a request reaches you through any channel you use for contact, not when it reaches the privacy team. Log the received timestamp, channel, what the person asked for in their own words, and the identifiers they gave. Compute the due date immediately against the shortest applicable deadline.

Requests rarely use the right vocabulary. "Please remove me from everything" might be a deletion request, a marketing opt-out, or both. "What do you know about me?" is an access request. When it is genuinely ambiguous, ask, but under California's rules an unclear request still gets a confirmation of receipt within 10 business days.

Step 2: decide which law applies

You often won't know where the person lives. Practical options: ask on the form, infer from account data, or apply your most protective standard to everyone. Many companies take the last route for access and deletion because running two processes costs more than the occasional request they could legally have declined. If you limit rights to residents of certain states, make sure the rule is written down and applied consistently.

Step 3: verify the requester

Match the verification to the risk. Opt-outs need little or none; California forbids requiring a verifiable request for them. Access to specific data and deletion of anything sensitive need more. For account holders, a login or confirmation link to the email on file is usually enough, and the EDPB considers demanding ID from an already-authenticated person disproportionate. The detailed standards are in the automation guide.

If an agent submits the request, California allows you to ask for the consumer's signed permission and to have the consumer verify or confirm directly (11 CCR 7063). Agent services are covered in requests from Mine, Privacy Bee and other agent services.

Step 4: find the data

Work from your data inventory, not memory. For each system: search by every identifier you hold for the person, record what you found (including "nothing"), and note who did the search. Include processors and service providers; your contracts with them should commit them to help. If you do not have an inventory yet, the request queue is a good reason to start one; see data mapping and discovery and the data map template.

Step 5: act on the request

  • Access: compile, then review. Remove other people's data, apply any exemption, and add the explanatory information the law requires. A raw export is not a complete response under the GDPR.
  • Deletion: for each system, delete, de-identify or retain under a documented exception. Keep a minimal suppression record so the person does not come back through the next data import. Tell processors, and under the CCPA, third parties you sold or shared the data with.
  • Correction: check the claim, fix the system of record, and let it propagate. Under the GDPR and LGPD, tell recipients of the data about the correction.
  • Opt-out: flag the record and stop the flows: ad platforms, data-sharing partners, audience exports. This is the shortest deadline in the matrix.

Step 6: respond and close

Send the response through a secure channel, say what you did and did not do, and explain any refusal with enough detail that the person understands it. Under US state laws, tell them how to appeal; under the GDPR, tell them they can complain to a supervisory authority. Then close the record with the evidence attached.

Step 7: keep the records

California requires records of requests and responses for at least 24 months (11 CCR 7101). Under the GDPR, the accountability principle means you need to be able to show how you handled any request a regulator asks about. In both cases the record should show the timeline, the verification, the systems searched and the outcome, without becoming a second store of the personal data itself.

Where requests go wrong

  • The request sat in a shared inbox for two weeks. Monitor every address that is published as a privacy contact, and train support teams to forward anything that mentions privacy rights.
  • The extension notice was never sent. Every law that allows an extension requires you to tell the person within the original window. Make the notice a workflow step, not a reminder.
  • The search missed a system. Usually a recently adopted SaaS tool. Tie procurement to the data inventory so new tools are added before they hold data.
  • The access package included someone else's data. Support ticket threads and shared accounts are the usual culprits. Review before sending.
  • The deletion came back. A nightly sync from a system that was not in scope re-created the record. Suppression lists and system-of-record discipline prevent this.

Sources