Privacy governance and rights requests

What the engagement delivers

We define responsibilities, request classification, identity checks, internal escalation and evidence retention. The process is mapped to the applicable legal framework and commencement stage rather than copied from another jurisdiction.

1. Identify the covered services, request channels and responsible teams.
2. Map request types to systems and decision owners.
3. Prepare the agreed intake, assessment and response procedure.
4. Hand over an evidence log and the implementation questions still open.

The procedure should distinguish receiving a request, verifying relevant facts, deciding the response and completing the action. A closed support ticket alone does not establish that every downstream task was completed.

Information to organise

• Contact channels
• system owners
• data locations
• verification options
• request history
• retention policies
• processor assistance terms.

Use redacted examples to show how requests currently move between support, product and suppliers. Identify where the same person may have more than one account or customer relationship. Collect only the verification information appropriate to the process being assessed, rather than defaulting to a full identity-document pack.

A design or evidence issue to resolve

A deletion request may affect several systems while some records have a separate retention basis. The workflow should record the decision for each record group and avoid promising an action the system cannot perform.

For example, an account may be removed from the main application while an associated support record is retained for a separately assessed purpose. Record the systems checked, the decision and its basis, and the communication approved for the requester. Avoid a blanket promise that does not match the actual treatment.

Boundaries and next steps

Operational staffing, system automation and handling contested individual requests are separately scoped.

The written scope identifies products, entities, jurisdictions, deliverables and fees. Share an initial description rather than confidential source code or personal datasets through the public enquiry form.

The deliverables can include a responsibility map, request register format, response templates and escalation rules. System changes, staff training and ongoing case handling are included only if specified. The handover should identify who maintains the process when products, suppliers or applicable requirements change.