Subject Request
Access requests on time, deletion with proof
Subject Request takes every request from a data subject from receipt to closure: verify identity, search your systems for the data, prepare the response, keep deadlines in view. Erasure requests go to Data Deletion with four-eyes approval and come back with proof.
From intake to closure
- 1
Intake
Record the request and document how the identity was verified – for example by ID document, existing customer login or video identification. Without verified identity, the case cannot proceed.
- 2
Search and response
For an access request, the connected applications are searched – automatically via the database or interface, or by the system owners. The response document is generated from your template.
- 3
Deletion
An erasure request goes to Data Deletion with four-eyes approval. The result of the deletion is returned to the case.
- 4
Case closure
An access request is closed only with a response document, an erasure request only once its result is in. Delivery – by post, email or in person – is recorded.
Deadlines under control
The dashboard shows at any time which cases are pressing.
Open cases
All requests that have not yet been closed.
Due within 7 days
Cases whose deadline expires within the next week.
Overdue
Cases whose deadline has passed.
Extended deadlines
Cases with a justified extension of the deadline.
Set up once, every request handled just as cleanly
Applications
Which systems are part of an access request, who is responsible and whether they are queried via the database or manually.
Information objects
Which details the response contains and which column in which system maps to which field.
Response templates
Structure and output format of the response to the data subject.
Traceable at every step
Four-eyes principle
Deletion orders are approved by a second person before anything is deleted.
Audit trail
Every action in the case is recorded with person, role and time.
Deadlines and delivery
The deadline, any extension and the delivery of the response are recorded for each case.
Working together with the other modules
Service
Architecture and integration
We connect your applications for access and erasure requests – with the data your applications hold on a person, response templates and workflow.
Frequently asked questions about Subject Request
How much time do we have to respond to an access request?
Under the Swiss FADP, generally 30 days; under the GDPR, one month. Both allow an extension – under the FADP by communicating the new deadline, under the GDPR with a justification. Subject Request tracks the deadline for each case and shows extended deadlines separately.
Which systems can be queried?
Applications with a supported database or REST interface are searched automatically. For systems without direct access, the system owners check themselves and enter the result.
What if a system cannot be searched?
Then the result is recorded and confirmed manually. The case records who entered what.
How is identity verified?
You verify the identity in your usual way, for example by ID document, via an existing customer login or by video identification. Espresso records how and by whom it was verified; without verified identity, the case cannot be processed further.
How are erasure requests carried out?
After approval by a second person, the deletion order goes to Data Deletion. The result of the deletion is returned to the case.
How do we get started?
With a 30-minute demo. Afterwards, we will clarify whether an assessment, a proof of concept or going straight to implementation is the right next step.
See Espresso in 30 minutes
We will show you the cockpit with sample data – and discuss where you should start.
Request a demoor write directly to info@espressodataprivacy.com