GDPR Readiness: Building Your Data Privacy Plan

Responding to Information Requests Under the GDPR, every individual has rights over their personal data — and your organization has a legal obligation to respond when those rights are exercised. An Information Request Procedure is the step-by-step process your team follows whenever someone contacts you about their personal information. Why You Need a Clear Procedure Without a documented process, information requests can be handled inconsistently — or worse, ignored. A clear procedure ensures that any employee who receives a request knows exactly what to do, even if your privacy officer is unavailable. The Rights Your Procedure Must Address Your Information Request Procedure should outline how to respond to each of the following: Right to be informed — the individual asks whether you hold their personal data Right of access — the individual requests a copy of all the personal data you hold on them Right to rectification — the individual provides evidence that their data is inaccurate and requests a correction Right to erasure — in circumstances such as withdrawal of consent, the individual requests that their data be deleted Right to restrict processing — the individual asks that you store their data but stop using it for processing Right to object — the individual objects to a specific use of their data, such as direct marketing Key Rules to