A person asks you for access to their data, its erasure or rectification, the restriction of its processing, its portability, or objects to a processing activity (articles 15 to 22 of the GDPR). Their request arrives at the regulated requests desk, which counts the time limit, carries the formal answer and keeps the evidence. The execution case applies the request to all the data MyZapp holds about them, module by module.
Only data protection officers (and administrators) open and handle these cases: they carry the person's identity.
Open the case from the request
- Open the request (for example "Right of access") in Regulated requests.
- In the Execution in the application card, click Carry out the request in the application.
- The case opens with the right of the request type and the requester's name, address, phone and identity document. Complete it if needed, then Open the case.
A request has only one open case at a time. You can also open a case by hand from Data protection âș Data subject requests âș New case, for example for a request received outside the desk.
While the case is open, the formal answer to the request cannot be sent: the desk shows "The request is being carried out in the application".
The steps
| Step | What you do |
|---|---|
| 1. The person and the right | Check the search criteria: account, address, phone, document. Each module looks for the person by every criterion given. For a rectification, enter the correct values; for an objection, the purpose concerned. |
| 2. Identity | Establish the identity in a proportionate way (article 12.6): Established (proof received), Check not needed (authenticated account, low-risk data) with the reason, or Not established, which refuses the request. To suspend the time limit while waiting for proof, request additional information on the request. |
| 3. Where their data is | Search the application lists, per module, the number of records found. Nothing is changed. |
| 4. Execution | Depends on the right, see below. The result shows per module: done, refused and why, failed. |
| 5. Outcome | Close the case: the formal answer can be sent. Or Refuse a manifestly unfounded or excessive request (article 12.5), with reasons included in the answer. Or Cancel a duplicate. |
What each right does
- Access: a response package (ZIP file) gathers one data file per module and a readable report: purposes, data categories, recipients, retention period, legal basis, source of the data, automated decisions, transfers outside the Union, and what is kept and why. The package is attached to the request file and becomes part of its evidence. You can also download it from the case.
- Portability: the same package, limited to the data processed on the basis of consent or contract (article 20).
- Erasure, rectification, restriction, objection: these rights change data. Nothing is applied without your approval: tick "I approve the execution across the whole application" before clicking. What the law requires to keep (invoices, evidence of requests, security logs) is refused with its reason and, when known, the end date of the retention.
- Automated decision: the report states whether a module takes a decision based solely on automated processing (article 22).
If a module fails, the case stays open: run the execution again, it resumes what is missing.
Objection and restriction: the person is added to the objection and restriction list, which the CRM checks before any sending â even for a record created later. To lift a restriction, first inform the person (article 18.3), then click Lift the restriction in the case: the lifting is dated.
Systems outside the application and recipients
Part of the person's data often lives elsewhere: payroll, video surveillance, line-of-business software. The processing register knows them. On execution, the case creates a task for each register activity whose data sit in an external system and whose rights are carried out by hand.
- The task is assigned to the system's owner account entered in the register ("Owner's account" field), otherwise to the members of the owner group, otherwise to you. It carries the request's deadline and the register's instructions.
- The owner receives a notice, then one reminder a day as the deadline approaches. They open the task in Data protection âș Request tasks (or through the link in the notice), see the person to look for while the task is open, carry out the request in their system, then attach the proof: a written statement or a file (the data export for an access request). If the person is not in their system, they close the task with that reason.
- After a rectification, an erasure or a restriction, a task also asks you to notify the recipients of each activity concerned: processors, authorities, AI provider (Article 19). Write down who was notified and how, or give the reason why it is impossible or involves disproportionate effort.
The case's Tasks outside the application card shows their progress. The case closes only once every task is done or closed with a reason; the formal answer therefore waits for the last one. Canceling the case cancels its tasks.
In the demo data
The "Data protection" demo data step plays a request end to end, after the regulated requests step:
- the demo access request has a closed case: identity verified, search across the application, package added to the request, and three external system tasks closed by their owners (payroll, done with a written statement; video surveillance and the processor's tool, justified). Only the formal answer on the request is left to write;
- the erasure request has an open case, stopped at the preview: nothing is erased. You can use it to show the search result before anything is executed.
Replaying the step never creates a second case for a request that already has one.
Good to know
- The reports of the case contain no personal data: only modules, states, numbers and reasons.
- The values of a rectification are removed from the case when it is closed.
- The formal answer is written on the request, as usual, once the case is closed.
Proof of consents
Data protection âș Consents finds, by a person's email address, everything they accepted or refused: purpose, date, channel, version of the text read and the module that collected it, including texts accepted when signing up. You can withdraw a consent there at their request (in writing or orally): the withdrawal is recorded under your name. The register is never erased: it proves the consent (art. 7.1).