Privacy requests
Every Person’s request to access, correct, export, object or erase is answered within its legal deadline.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 P5.1 | The entity grants data subjects access to their stored personal information for review and copy. |
| SOC2 P5.2 | The entity corrects or amends personal information at a data subject’s request and tells third parties of the change. |
| SOC2 P7.1 | The entity collects and maintains accurate, up-to-date, complete and relevant personal information. |
| SOC2 P8.1 | The entity receives, addresses and resolves privacy inquiries, complaints and disputes, and monitors its own compliance. |
| GDPR Art.15 | A data subject obtains confirmation of processing and a copy of their personal data on request. |
| GDPR Art.16 | A data subject obtains correction of inaccurate personal data without undue delay. |
| GDPR Art.17 | A data subject obtains erasure of personal data without undue delay when a listed ground applies. |
| GDPR Art.20 | A data subject receives their personal data in a structured, machine-readable format and may move it elsewhere. |
| GDPR Art.21 | A data subject objects to processing based on legitimate interest or for direct marketing, and marketing processing stops. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every privacy request received in the report period. |
| Assert | Each closed within its legal deadline, and each erasure resolved to a Suppression plus a read restriction. |
Owner
Example
A parent asks a tutoring marketplace to erase her data. Within 30 days her records gain a Suppression and a read restriction, and she gets confirmation.