Procedure

Data Subject Rights Management Procedure

This procedure defines the end-to-end process for receiving, validating, fulfilling, and documenting requests from individuals exercising their rights over personal data held by the organization. It ensures that compliance with applicable data subject rights obligations under GDPR, UK GDPR, PIPEDA, PIPL, and related laws is maintained, and establishes consistent standards for identity verification, response timelines, denial justification, and record keeping.

Type

Procedure

Version

1.6.50

Date

2026-10-31

Owner

Data Protection Officer

Approving authority

Governance Library Maintainer

Classification

Public

Confidentiality

Public

Category

Privacy

Review frequency

Annual and upon material privacy, regulatory, or AI governance change

Licence

CC BY-SA 4.0

Read the full text on GitHub → (opens in a new tab)

Outline

• 1. Purpose and scope
• 2. Governance
• 3. Rights catalogue
• 4. Request intake
• 5. Triage and assessment
• 6. Fulfilment workflow
• 7. Denial and exemptions
• 8. Cross-border and AI considerations
• 9. Record keeping
• 10. Metrics
• 11. Framework alignment

Frameworks it maps to

• ISO/IEC 27701:2025 (PII principals' rights)
• CSA CCM v4.1 DSP-11, DSP-01
• GDPR Art. 15
• UK GDPR Art. 15
• PIPEDA Sch 1 Principle 9 (Individual Access)
• PIPL Art. 45
• EDPB Guidelines 01/2022 on the right of access (v2.1)
• GDPR Art. 16
• UK GDPR Art. 16
• PIPEDA Sch 1 Principle 9 (amendment)
• PIPL Art. 46
• GDPR Art. 17
• UK GDPR Art. 17
• GDPR Art. 20
• UK GDPR Art. 20
• GDPR Art. 18
• UK GDPR Art. 18
• GDPR Art. 21
• UK GDPR Art. 21
• PIPEDA Sch 1 Principle 3 (withdrawal of consent)
• EU GDPR Art. 22
• UK GDPR Arts. 22A-22D (per the UK annex)
• GDPR Art. 37 to 39
• ISO/IEC 27701:2025 §5.3, Annex A.1.2.9, A.3.4

Related documents

• Privacy and Data Governance Policyprivacy
• Privacy Management Programme Charterprivacy
• Records Retention and Destruction Standardgovernance