Individual Rights
How to Handle a Data Subject Request
A six-step process for Jamaican businesses to recognise, record, verify and respond to data-subject rights requests under the Data Protection Act.
What you will learn
- How to recognise a rights request in plain language
- What to record about each request
- How to verify identity proportionately
- How your Personal Data Register helps you locate information
A customer emails, "Send me everything you have about me." An employee asks you to correct information in their record. Another person asks how their information is being processed.
These requests should not be treated as ordinary customer-service tickets.
Step 1, Recognise the request
Staff should know how to recognise a data-protection rights request even when the person does not use legal terminology.
Step 2, Record it
Capture:
- requester;
- date received;
- request type;
- responsible person;
- relevant systems;
- identity-verification status;
- deadline;
- actions; and
- outcome.
Step 3, Verify appropriately
You need reasonable confidence that information is being provided to the correct person. But avoid collecting excessive new information simply to verify identity.
Step 4, Locate the information
This is where your Personal Data Register becomes valuable. It can help identify systems, departments, processors, records and information sources.
Step 5, Review before disclosure
Information may contain data relating to other individuals or raise applicable legal considerations.
Step 6, Respond and document
Maintain an audit trail of the response and decisions made.
Put this into practice
Log requests, track deadlines and maintain an audit trail of your response.
Manage a Data Subject RequestFrequently asked questions
Key takeaways
- Recognise a rights request even when the person does not use legal terminology.
- Record the requester, type, systems, deadline, verification status and outcome.
- Verify identity with reasonable confidence, without collecting excessive new information.
- Your Personal Data Register helps you locate the relevant systems and records.