How to Process DSR Requests

Overview

This guide walks through the complete process of handling Data Subject Rights (DSR) requests from submission to completion.

Request Types

Access Request

User wants copy of their data

1. 30-day legal deadline
2. Export in machine-readable format
3. Full scope of processing

Deletion Request


User wants data erased

4. “Right to be forgotten”
5. Permanent deletion
6. May have legal exceptions

Portability Request


User wants data in transferable format

7. JSON or CSV export
8. Complete data transfer
9. User can move to another service

Rectification Request


User wants to correct incorrect data

10. Update personal information
11. Admin review required
12. Limited scope

Step 1: Request Submission


User Submits Request


13. User visits DSR Portal at /privacy-requests/
14. Selects request type: Access, Delete, Portability, Rectification
15. Enters email address: Must match account or receive verification
16. Provides details:

– Requestor name
– Identifying information
– Specific data requested
– Explanation (optional)

17. Submits request

Verification Email Sent


System automatically:

18. Sends verification email
19. Includes confirmation link
20. Link valid for 24 hours
21. Tokens are unique and expire

User Verifies Identity


22. Opens email
23. Clicks verification link
24. System marks as verified
25. Shows request confirmation
26. Provides tracking reference

Step 2: Admin Notification


Admin Dashboard Alert


27. New request notification sent to admin email
28. SLOS Dashboard shows new request badge
29. Pending Requests queue updated
30. Email contains:

– Request type
– Requester email
– Submission time
– Link to review

Check Request Details


31. Go to SLOS → DSR Portal → Requests
32. Click Pending tab
33. Locate request in list
34. Click to open details
35. Review all information

Request Details Show:

36. Request type (access, deletion, etc.)
37. Requester email and name
38. Submission time
39. Verification status
40. Deadline (30 days or custom)
41. Days remaining
42. Priority level (auto-calculated)
43. Assigned user

Step 3: Verification & Assignment


Verify Requester Identity


44. Open request details
45. Scroll to Verification Status
46. Review verification:

– ✓ Email verified (automatic)
– ⊗ Manual verification needed (optional)

For high-risk requests:

47. Add Internal Notes:

`
Additional verification completed via phone.
Confirmed identity with last 4 digits of SSN: 1234
`

48. Update status to verified
49. Mark complete date

Assign to Team Member


50. Click Assign To dropdown
51. Select team member responsible
52. Choose from admin users
53. Can reassign later if needed
54. Assignee receives notification

Set Priority


55. Auto-priority based on:

– Request type
– Deadline urgency
– Requester profile
– Special notes

56. Manual priority:

– Click Priority dropdown
– Select: High, Normal, Low
– High priority shows first in queue

Step 4: Data Collection


Automatic Collection


For most requests, data auto-collects from:

57. User account data
58. Post history
59. Comment history
60. Metadata
61. Consent records
62. Scan results

Manual Data Identification


For complex requests:

63. Identify data sources:

– User profile
– Posts/pages authored
– Comments
– Custom fields
– Media files
– Transactions
– Support tickets
– Analytics records
– Third-party services

64. Check external sources:

– CRM systems
– Email services
– Analytics platforms
– Payment processors
– Backup storage

Collect Third-Party Data


If you use external services:

65. Go to DSR Portal → Settings
66. Enable Third-Party Integration
67. For each integrated service:

– Send data request
– Collect response
– Include in export

Step 5: Process Request


For Access Requests


68. Collect all data:

– WordPress user data
– Post history
– Comments
– Site analytics
– Tracking records
– Consent history

69. Prepare export:

– Select format (JSON, CSV, PDF)
– Verify completeness
– Test download link
– Ensure readability

70. Review for accuracy:

– Verify all data correct
– Check no sensitive internal notes
– Confirm personal data complete

71. Mark as ready:

– Change status to “Ready for Export”
– Generate download link
– Set expiration (7 days recommended)
– Send to requester

For Deletion Requests


⚠️ IMPORTANT: Follow careful process

72. Create backup:

– Export user data before deletion
– Store in secure location
– Document timestamp
– Keep for compliance (30 days minimum)

73. Review for exceptions:

– Legal obligations (taxes, contracts)?
– Active disputes?
– Ongoing litigation?
– Regulatory holds?
– Document any exceptions

74. Prepare deletion:

– List data to be deleted
– Verify scope with admin/legal
– Check for dependencies
– Plan deletion sequence

75. Execute deletion:

– Delete user account (soft delete first)
– Delete authored content (if approved)
– Delete comments
– Delete personal data
– Clear tracking cookies
– Update third-party services

76. Confirm deletion:

– Document completion time
– Verify data gone (spot check)
– Archive backup
– Send confirmation email
– Update request status

For Portability Requests


77. Collect all data:

– Same as access request
– Comprehensive data gather
– Include third-party data
– All formats possible

78. Format for transfer:

– Use standard format (JSON preferred)
– Portable structure
– Complete metadata
– Clear documentation

79. Verify completeness:

– All user data included
– Accurate and current
– Properly formatted
– Can be imported elsewhere

80. Prepare export:

– Create ZIP file
– Include all formats
– Add documentation
– Secure transfer method

For Rectification Requests


81. Review correction request:

– What data is incorrect?
– What should it be?
– Request evidence?

82. Verify accuracy:

– Is request valid?
– Have records?
– Can we verify?

83. Make correction:

– Update user profile
– Update metadata
– Log change
– Document date/time

84. Notify requester:

– Send confirmation
– Show updated data
– Explain changes made
– Ask for verification

Step 6: Quality Assurance


Review Export Before Sending


85. Completeness Check:

– All categories included
– No data truncated
– All attachments present
– Complete records

86. Accuracy Check:

– Data is current
– No errors
– Dates correct
– No sensitive internal info

87. Privacy Check:

– No internal notes exposed
– No other users’ data included
– No business secrets
– Only user’s own data

88. Format Check:

– Proper formatting
– File not corrupted
– Readable structure
– Test download

Test Download Link


89. Copy download link
90. Open in incognito browser
91. Verify download works
92. Check file size reasonable
93. Verify content complete

Step 7: Send to Requester


Generate Download Link


94. Go to request details
95. Click Generate Download
96. System creates unique link
97. Link expires in 7 days
98. One-time download option available

Send Notification Email


99. Click Send Download Notification
100. System sends automated email with:

– Unique download link
– Instructions for accessing data
– Link expiration date
– Contact info for questions
– Confirmation of completion
– SLA confirmation

Document Completion


101. Update Request Status to “Completed”
102. Add Completion Notes:

`
Export generated 2025-01-15
Format: JSON
Size: 2.4MB
Download notified via email
`

103. Record Completion Date
104. Save changes

Step 8: Compliance Documentation


Keep Audit Trail


105. Document everything:

– Request date
– Requester identity
– Verification method
– Data collected
– Completion date
– Export method
– Notification sent
– Download status

106. SLOS auto-documents:

– All actions logged
– Timestamps recorded
– User actions tracked
– Email copies saved

Generate Compliance Report


107. Go to SLOS → DSR Portal → Reports
108. Select date range
109. Choose report type:

– All Requests
– Response Times
– SLA Compliance
– By Request Type
– By Status

110. Download PDF/CSV

SLA Compliance


Monitor 30-day deadline:

111. Dashboard shows:

– Days remaining
– Color coded urgency
– Approaching deadline alerts
– Overdue flags

112. Alerts:

– 7 days before deadline
– 1 day before deadline
– After deadline (escalation)

Step 9: Follow-Up


After Completion


113. Check for follow-up:

– User has 7 days to download
– Monitor download status
– Follow up if not downloaded

114. Archive:

– Move to completed folder
– Keep records for audit
– Annual retention review
– Delete per policy

Deletion Request Special Follow-Up


115. 30-day hold:

– Keep backup 30 days
– Verify deletion complete
– Check no data reappears

116. Spot checks:

– Verify user can’t login
– Verify profile deleted
– Verify data not accessible
– Check third-parties removed

117. Final deletion:

– After 30 days delete backup
– Document final deletion
– Update status to “Permanently Deleted”
– Archive record

Troubleshooting


Data Not Exporting


118. Check file permissions
119. Verify disk space
120. Review error log
121. Increase PHP memory
122. Try smaller export first

Email Not Sending


123. Verify SMTP working
124. Check email address valid
125. Look for bounces
126. Add to allowed list
127. Test mail function

User Can’t Download


128. Verify link not expired
129. Check IP not blocked
130. Test link yourself
131. Resend with new link
132. Offer manual delivery

SLA Deadline Approaching


133. Prioritize request
134. Assign to senior staff
135. Expedite data collection
136. Request extension if necessary
137. Document any delays

Best Practices


138. Act Promptly – Start within 24 hours
139. Stay Organized – Use SLOS tracking
140. Document Well – Detailed audit trail
141. Verify Data – Quality assurance check
142. Secure Delivery – Protect data in transit
143. Meet SLA – 30-day deadline (GDPR)
144. Train Staff – Team knows process
145. Regular Audits – Review quarterly

Legal Considerations


⚠️ Important:

146. Consult with legal team
147. Understand applicable laws
148. Document all decisions
149. Exceptions require justification
150. Follow regulatory guidance
151. Have retention policy

Next Steps


152. Set up DSR Portal
153. Train team on procedures
154. Create documentation
155. Test with sample requests
156. Monitor SLA compliance
157. Adjust as needed

Related Articles


158. Setup DSR Portal
159. Export User Data
160. Privacy Compliance