Skip to main content
OpsRoadmaps

Checklists / data-subject-request-handling

Data Subject Request Handling Checklist

Run one access or deletion request end to end and find out whether you can actually meet the deadline — before a regulator sets it for you.

9 steps · 8 required · last reviewed (next review 2027-03-20) · updated 2026-09-20

Related focus areas:PrivacyOps

Sign in to run this checklist

This is a rehearsal, and it should be run against a real (or realistically seeded) account. Most organisations discover their request process is theoretical only when the clock is already running.

This checklist is an operational readiness aid. It is not legal advice, and it does not establish that any particular legal obligation is met — that determination belongs to your counsel and depends on the jurisdictions and data involved.

  1. There is one intake route for requests and it is discoverable by a user

    required

    If the only route is emailing support and hoping, your clock starts whenever someone notices.

  2. The deadline clock starts on receipt and is tracked per request

    required

    Deadlines are counted from when the request arrived, not from when it was triaged.

  3. Identity is verified proportionately before any data is disclosed

    required

    Handing an account's data to the wrong person is a worse outcome than a slow response.

  4. A current data map says which systems hold personal data, including backups and logs

    required

    You cannot export or delete from systems you have forgotten. Logs and backups are where maps are usually wrong.

  5. An export can be produced in a portable, machine-readable format

    required

    A PDF of a screen is not portability — the recipient has to be able to load the data somewhere else.

  6. Deletion propagates to downstream systems, analytics, and third-party processors

    required

    Deleting the row and leaving the warehouse copy is the most common incomplete deletion.

  7. Records of each request and its resolution are retained

    required

    The record of what you did is the only thing that demonstrates you did it.

  8. A dry run has been completed in the last twelve months and its duration measured

    required

    The measured number is what tells you whether the process fits inside the deadline.

  9. Refusals or partial responses cite a stated reason and are reviewed

    optional

    Refusals are where process quietly becomes risk; they deserve a second reader.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-20 — adapt them to your own environment.