Operational guides for answering access, erasure and other rights requests on time: the response process, identity checks, finding data across systems, backups and logs, and repetitive or abusive requests.
A DSAR process that meets the GDPR: intake channels, the one-month deadline and extension, searching every system, what the copy and supporting information must include, answering in the requester's format, and documenting each request.
How much identity checking a controller may do before answering a rights request: when doubt is reasonable, proportionate verification, why excessive ID demands draw enforcement attention, and what applies when the controller cannot identify the person at all.
How to honour erasure requests where data lives in backups, logs and copies: the grounds and exceptions, telling recipients, why anonymisation often fails as a substitute, and how backup and log design affects both restoration and deletion.
Data mapping for rights requests: why the record of processing and an inventory of systems and processors decide response time, search criteria the EDPB expects, processor assistance duties, and passing results on to recipients.
When a controller may charge a fee for or refuse a rights request, how to calculate a reasonable fee, the burden of proof, the reasons and remedies that must be given within one month, and an enforcement case on obstructive request channels.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.