Responding to Data Subject Rights

What is Data Subject Rights Request?

Data Subject Rights (DSRs) request is request about (and identifying) a living person, made by that person or by a third party with appropriate authority acting on behalf of the person to exercise their rights, governed by Article 15 of the GDPR. 

Under Article 12(2) of the GDPR, comply with a DSR without undue delay and, in any event, within one month (i.e. a calendar month) of receiving a request from a data subject or their representative. Any refusal of a DSR must also meet this timescale.

Taking account of the complexity and number of requests made by the data subject, the period for responding may be extended by a further period of two months. Data subject must be informed of any extension, with reasons, within one month of receipt of the request.

Data Subject Rights Request Handling Procedure

DS Requests under GDPR apply to personal data/information/files/records relating to data subjects. The following general points apply to all of the requests described in this document and are based on Article 12 of the GDPR:

1. We have to provide requested Information to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
2. Data subjects can make a request verbally or in writing. It can also be made to any part of Vendasta (including by social media) and does not have to be to a specific person or contact. It does not have to include the title of the request formally or mention Article number of the GDPR, as long as it is clear that the data subject is making a request about it’s own personal data.
3. We have a legal responsibility to identify data subject ( if a representative is acting on behalf of data subject then we have a legal responsibility to verify it’s authorization as well). In case of doubt about identity, we may request further information to establish it.
4. We must act on a request from a data subject, unless we are unable to establish their identity.
   1. We must provide information without undue delay and within a maximum of one month from the receipt of the request.
   2. The response timescale may be extended by up to two further months for complex or a high volume of requests – the data subject must be informed of this within one month of the request, and the reasons for the delay given.
5. If a request is made via electronic form, the response should be via electronic means where possible, unless the data subject requests otherwise.
6. If it is decided that we will not comply with a request, we must inform the data subject without delay and at the latest within a month, stating the reason(s) and informing the data subject of their right to complain to the supervisory authority.
7. Generally, responses to requests will be made free of charge, unless they are “manifestly unfounded or excessive” (Article 12 of the GDPR), in which case we will either charge a reasonable fee or refuse to action the request but the data subject must be informed of this within one month of the request, with the reasons.

Important to Note:

Pursuant to Article 29, the GDPR simply states to use “all reasonable measures” to verify the identity of  requestor and ensure to not disclose personal data to the wrong person, infringe any data subject rights, or make it too difficult for the data subjects to exercise their rights, any of which would violate the GDPR.