In forceGDPR rights8 min read

GDPR Data-Subject Request Workflow: Seven Practical Steps

A reliable GDPR rights process separates the requested action from the duty to communicate. Every request should be recorded, assessed, assigned, timed, completed, answered and supported by proportionate audit evidence.

Applies from: 25 May 2018
For: Controllers, privacy owners, support teams and online service operators
Last legally reviewed: 30 September 2026

Educational guidance: This overview explains EU rules in general terms. Applicability depends on the organisation, system, service and national law.

Record every request and recognise informal wording

Create one case record when a request arrives through an account, email, support message or another accepted channel. Record the received time, requester, wording, right or rights that may be involved, likely systems and current status.

A person does not need to quote an article number or use a formal template. Staff who receive requests should know how to route them without losing the original message or starting duplicate cases.

Verify proportionately and assign an owner

Request additional information only where there are reasonable doubts about identity. Use the least intrusive method appropriate to the risk, such as an authenticated account or a known communication channel, and avoid collecting identity documents by default.

Assign a responsible owner and record the initial one-calendar-month response date. Escalate early where data spans systems, information about other people may be involved, or an exception or extension needs legal assessment.

Complete the action across the relevant systems

Assess whether the right applies, locate the relevant personal data, protect the rights and freedoms of others and record any exception. Coordinate with processors or recipients where the GDPR requires it.

Record what was searched, exported, corrected, restricted, erased or retained and why. Automatic deletion is only a system action; it does not complete the communication duty.

Respond and retain proportionate evidence

Tell the individual what action was taken. If the controller does not act, provide the reasons and the required information about complaining to a supervisory authority and seeking a judicial remedy. A permitted extension must also be communicated within the first month with reasons.

Retain the request, identity-verification decision, owner, deadlines, reasoning, actions, response copy and dispatch evidence for a defined period. Do not keep unnecessary identity documents or duplicate the underlying personal data in the audit trail.

Action list

Practical checklist

Record every request and its received time.
Verify identity only where appropriate and proportionately.
Assign a responsible owner.
Track the initial one-calendar-month response period and any valid extension.
Complete the assessed action across relevant systems and recipients.
Confirm the result, refusal or extension to the individual.
Retain a proportionate audit record under a defined retention rule.

Questions

Common questions

Does every erasure request require deleting every record?

No. The right to erasure has conditions and exceptions. The controller must assess the request, document the outcome and answer the individual even where some information must be retained.

Is the GDPR response period always 30 days?

No. Article 12 states one month, which should be calculated as a calendar-month period. Complex or numerous requests may permit up to two further months when the person is informed within the first month and given the reasons.

Does automatic deletion complete the request?

No. The controller must still communicate the action taken, or explain why it did not act, and keep appropriate evidence that the response was sent.

Primary material

Official sources

Last legally reviewed: 30 September 2026. Recheck the consolidated legislation and relevant national implementation before relying on this guide for a specific decision.