Data-Subject Requests

By the end

What you'll build

• Run a request intake that captures scope, identity and clock-start correctly
• Verify identity proportionately without collecting more data than the request needs
• Scope and execute a search across structured systems, mailboxes and unstructured stores
• Apply third-party redaction and exemption reasoning to a real disclosure set
• Draft a response pack and covering letter that is complete, accurate and defensible
• Recognise the request types that must be escalated to legal before any response goes out

Curriculum

What's inside

8 modules · 51 lessons

1. 01

   Intake and recognition

   6 lessons
   • Recognising a request that was never labelled as one
   • Requests arriving by phone, chat, social channel or complaint
   • Logging: what to capture and when the clock starts
   • Requests made by agents, parents, guardians and representatives
   • Acknowledging without conceding anything
   • + 1 more lesson
2. 02

   Identity and scope

   6 lessons
   • Proportionate identity verification: enough assurance, no more data
   • Verification for existing customers, staff and strangers
   • Clarifying scope without obstructing the requester
   • Whether a clarification pauses the clock
   • Recording your reasoning as you go
   • + 1 more lesson
3. 03

   Finding the data

   7 lessons
   • Search strategy across structured systems and unstructured stores
   • Building a search plan from the data inventory
   • Mailboxes, chat archives and collaboration tools
   • Backups, archives and the reasonableness limit
   • Custodian questionnaires and self-search discipline
   • + 2 more lessons
4. 04

   Exemptions, redaction and third parties

   7 lessons
   • Third-party data in a disclosure set: redact, withhold or seek consent
   • Common exemption families and how they are argued
   • Legal privilege and material prepared for litigation
   • Management-planning and negotiation material
   • Redaction mechanics and the flattening trap
   • + 2 more lessons
5. 05

   The other rights

   7 lessons
   • Erasure, objection, restriction and portability: what each one actually obliges
   • Assessing an erasure request against retention obligations
   • Objection and the grounds for continuing
   • Restriction as a holding state and how systems support it
   • Portability: format, scope and its limits
   • + 2 more lessons
6. 06

   Responding well

   6 lessons
   • Assembling a response pack that stands up to challenge
   • Covering letter structure and plain-English explanations
   • Secure delivery of the disclosure set
   • Refusals and partial responses: how to explain them
   • Extensions and complex-request reasoning
   • + 1 more lesson
7. 07

   Hard cases and escalation

   7 lessons
   • Requests during a dispute, and other cases that go to legal first
   • Manifestly unfounded, excessive and repeat requests
   • Requests from current or departing employees
   • Bulk and campaign-driven requests
   • Complaints, regulator involvement and follow-through
   • + 2 more lessons
8. 08

   Practice and check

   5 lessons
   • Which right obliges whatmatch pairs
   • Handling an access request end to endsequence order
   • Say it preciselyfill blank
   • The request nobody loggedscenario
   • Course quizquiz

The shape of it

How this course works