Best Practices: Managing Data Subject Rights & Requests

Data protection laws and regulations exact strict requirements on organizations that process personal data to intake, review, and fulfill data subject rights and requests. Privacy professionals in response can institute a privacy by design approach for handling data subject requests with GDPR, CCPA, and other regulatory compliance frameworks in mind. This solution requires organizations to consider the accountable manner in which they intake, review, and fulfill requests with respect to time, sensitivity, and volume.

About OneTrust Privacy Rights

OneTrust Privacy Rights enables organizations to streamline their Data Subject Access Requests (DSAR) lifecycle processes by leveraging intake templates, automated workflows, identity verification measures, secure messages portals, database audit preparedness, and Targeted Data Discovery (TDD). These powerful features allow privacy professionals to accommodate large volumes of requests while responding to each within a proper fulfillment time range, effectively and efficiently.

How it Works

Data subjects create requests using a branded web form that's linked from your organization's privacy policy web page. Once a request has been submitted via web form, assignees within your organization will be notified and can use the OneTrust application to process that request. Responses to the data subject will appear in a secure messaging portal where the data subject can provide additional context and, if necessary, upload identity verification documents. The fulfillment process then concludes with a decision regarding the data subject's request, which is subject to conditions mandated by compliance law and your organization's responsibility to notify the data subject on that decision.

Data collection for requests begins with setting up a web form with specific audiences, request types, and collection parameters in mind. From there, you can configure web forms to maximize request intake efficiency with visibility rules, ID verification, and attachment uploads while also maintaining the customer experience with guidance text and style branding. For more information on web forms, see Customizing a Web Form.



Workflows divide a data subject request into individual stages for more competent processing. This aids in the prioritization and fulfillment of the data subject request. Privacy teams can customize workflows by adding process stages, providing guidance text in multiple languages, and configuring subtasks within the individual stages. For more information about building and customizing workflows, see Adding and Deleting Workflows and Customizing a Workflow.



Response Templates can be leveraged as your organization's preferred method of contact when responding to requests in the Privacy Portal. Use the text editor to customize the style and format of your organization's custom message that notifies consumers a decision was made regarding their request. For more information on response templates, see Using Response Templates.



Best Practices and Expert Advice

Request Intakes

The customization of request intake methods is an initial priority for handling data subject requests. Privacy professionals should consider the following criteria when examining their organization's intake needs and capabilities regarding data subject access requests:

  • Data subject access to your organization's web forms

  • Data subject type(s) you choose to support based on your organization's business needs

  • Request type(s) your organization is liable for or likely to receive based on your organization's processing of data

  • Jurisdictions where you will be processing personal data and their applicable privacy laws and regulations

  • Where, how, and how long your organization chooses to store data subject access requests

After receiving a request, you will need to validate the data subject's identity and, in some cases, their residency. Identity verification can occur under the following three conditions:

  1. Users with existing verified accounts that possess personal credentials;

  2. Single sign-on (SSO) to provide data subjects with a singular authentication method for accessing related systems; or

  3. Attachment uploads through OneTrust's secure messaging portal, accessible from the Activity tab in the Data Subject Request Details screen.

OneTrust also supports integrations with customer databases and identity validation technologies, or you can create your own integration with an open API framework.

Task Fulfillment

Next to request intake customization, configuration of fulfillment workflows is paramount to organizational productivity. This first starts with identifying individuals responsible for processing consumer requests, as they should be knowledgeable on data subject rights and request frameworks. This knowledge will prove useful in gaining a greater understanding of how the OneTrust application optimizes the fulfillment process.

OneTrust recommends utilizing automated workflows and auto-assigning tasks to streamline request fulfillment across your organization. Automated workflows generate guidance text to assist with rule automation and subtask creation, while auto-assigning tasks helps distribute heavy influxes of requests to responsible parties. These efforts are well-rewarded in the event of an audit or regulatory inquiry as your organization will possess a well-maintained database of records and communication in OneTrust.

You can configure your DSAR workflows to integrate with other applications through Targeted Data Discovery (TDD). This is accomplished by adding a TDD subtask to your workflow that utilizes an integration workflow configured with API triggers and actions. The subtask will initiate a workflow that fetches data from the connected system and returns it to the request. Leverage TDD to automate data retrieval or deletion across your systems for more competent and efficient fulfillment.

Lastly, deciding the manner in which you respond to requests, honored or not, has a lasting impact on brand image and public trust. Choose one of OneTrust's default response templates and make changes as necessary to best reflect your organization's communication standards when responding to requests.