Data Subject Rights Request Log (Pointer)¶
UK GDPR Art 15-21. Controls PRIV-05. Status: not started.
Tier 2 — pointer only. Actual DSAR/erasure request contents include personal data and must not be stored in this repo. They live in the restricted store. This file records only the process and a non-identifying index so we can prove the process runs and meets statutory clocks.
Policy: policies/privacy-and-retention-policy.md.
Process (to be designed)¶
- Intake channel: TBD (ties to support intake,
READINESS.mdObservability). - Statutory response clock: 1 month (extendable to 3 for complex requests).
- Request types: access, rectification, erasure, portability, restriction, objection (incl. objection to profiling).
- Identity verification step before fulfilment.
- Erasure executes the deletion path in
readiness/data-inventory-and-retention.md(cascade + purge), with deletion propagation to ML perML-07.
Non-identifying index (when live)¶
| Ref | Type | Received | Due | Closed | Outcome | Restricted record |
|---|---|---|---|---|---|---|
| (none yet — pre-beta) |
Restricted store location: [to be designated] (Tier 2).