# Privacy requests

URL: /systems/trust-and-governance/controls/privacy-requests · Id: `control:privacy-requests`

> Every Person’s request to access, correct, export, object or erase is answered within its legal deadline.

Every [Person](/business/nouns/person)’s request to access, correct, export, object or erase is answered within its legal deadline.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 P5.1](/systems/trust-and-governance/criteria/soc2/p5-1) | The entity grants data subjects access to their stored personal information for review and copy. |
| [SOC2 P5.2](/systems/trust-and-governance/criteria/soc2/p5-2) | The entity corrects or amends personal information at a data subject’s request and tells third parties of the change. |
| [SOC2 P7.1](/systems/trust-and-governance/criteria/soc2/p7-1) | The entity collects and maintains accurate, up-to-date, complete and relevant personal information. |
| [SOC2 P8.1](/systems/trust-and-governance/criteria/soc2/p8-1) | The entity receives, addresses and resolves privacy inquiries, complaints and disputes, and monitors its own compliance. |
| [GDPR Art.15](/systems/trust-and-governance/criteria/gdpr/art-15) | A data subject obtains confirmation of processing and a copy of their personal data on request. |
| [GDPR Art.16](/systems/trust-and-governance/criteria/gdpr/art-16) | A data subject obtains correction of inaccurate personal data without undue delay. |
| [GDPR Art.17](/systems/trust-and-governance/criteria/gdpr/art-17) | A data subject obtains erasure of personal data without undue delay when a listed ground applies. |
| [GDPR Art.20](/systems/trust-and-governance/criteria/gdpr/art-20) | A data subject receives their personal data in a structured, machine-readable format and may move it elsewhere. |
| [GDPR Art.21](/systems/trust-and-governance/criteria/gdpr/art-21) | A data subject objects to processing based on legitimate interest or for direct marketing, and marketing processing stops. |

## Implemented by
- [Privacy](/workflows/processes/privacy)
- [Privacy request](/workflows/processes/privacy/privacy-request)
- [Privacy](/systems/privacy)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every privacy request received in the report period. |
| Assert | Each closed within its legal deadline, and each erasure resolved to a Suppression plus a read restriction. |

## Owner
[Privacy Officer](/agents/legal/privacy-officer), [Legal Team](/agents/legal).

## Example
A parent asks a tutoring marketplace to erase her data. Within 30 days her records gain a [Suppression](/business/nouns/suppression) and a read restriction, and she gets confirmation.