Privacy requests
Record data subject requests, track their deadlines, and complete, refuse or extend them with the record an auditor reads.
Privacy requests
People can ask you about their personal data: to see it, delete it, correct it, move it, object to its use or restrict it. Compliance › Privacy requests is the register where your team records each request and what you did about it, with its deadline.
Intake and verification
Safeguard does not take requests from data subjects directly. They reach you through your own channels, for example the Privacy contact email on your Trust Center, which the page shows for data subject requests and GDPR inquiries. Confirm the person's identity in your own process before you act. Then record the request in Safeguard.
Record a reference for the person, such as a ticket or case id, never their email address. The register is evidence an auditor reads, so it holds the request and its outcome, not the person's data.
Record a request
On Compliance › Privacy requests, choose Record a request and fill in:
| Field | What to enter |
|---|---|
| Request type | Access, Deletion, Rectification, Portability, Objection or Restriction. |
| Status | Received, In progress, Completed, Refused or Withdrawn. |
| Received on | The date the request arrived. Required. |
| Subject reference | A ticket or case id, never the person's email address. |
| Received through | The channel it came in by. |
| Notes | Anything your team needs. |
Deadlines
A request is due 30 days after it was received. You can extend the deadline to at most 92 days after receipt with an Extended due date (optional), which counts only with Why the deadline was extended filled in.
The Deadline column shows where each request stands:
| Deadline | Meaning |
|---|---|
| Open | Not finished, and still inside its deadline. |
| Overdue | Not finished, and past its deadline. |
| On time | Completed by its deadline. |
| Late | Completed after its deadline. |
| Refused with a reason | Refused, with the reason recorded. |
| Withdrawn | The person withdrew it. |
The page counts Open requests, Overdue and Deletion requests at the top.
Complete, refuse or withdraw
Open the request and set its status, with the date in Completed, refused or withdrawn on:
- Completed: you did what was asked.
- Refused: also fill in Why it was refused. The reason is what an auditor reads.
- Withdrawn: the person withdrew it.
Safeguard checks the record as you save: a completion date needs a finished status and the reverse, nothing can be completed before it was received, no date can be in the future, and the subject reference must not be an email address.
Each request keeps its history. A compliance reviewer records and edits requests; an auditor can read them.
The evidence it produces
Where it is switched on for your workspace, the automated test Deletion requests are completed within 30 days reads this register every day. For each deletion request received in the last year, or still open, it passes when the request was completed, or refused with a recorded reason, within 30 days of receipt or by a recorded, reasoned extension of at most 92 days. An open request past its deadline fails; one still inside it, or withdrawn, is not applicable. Results show the request's id, dates and outcome, never the subject reference.
The test is evidence toward SOC2 C1.2 and CC6.5, ISO/IEC 27001:2022 Annex A 8.10 and 5.34, and NIST CSF 2.0 GV.OC-03. To fix a failure, complete the deletion or refuse it with the legal reason, and record the outcome and its date on the request.