Lesson 12 of 26

Samira picks up a data subject request

For: Data Protection OfficerAbout 7 min

What you will be able to do

This lesson is for the Data Protection Officer. When a person asks for a copy of their data, the company has a set time to answer under the UAE data protection law, the PDPL. Logging the request is an event that starts Samira, the AI agent for data protection, by herself: she works out the deadline, starts the search for the person's data and says what is left for you. You will log an access request, follow Samira's work on the Work page and read her handover.

Before you start

  • You are signed in as the Data Protection Officer of Meridian Souq Trading LLC.
  • Yasmin Tahiri, a Meridian Rewards member, has e-mailed asking for a copy of her data; her identity was checked against her Emirates ID.

Steps

  1. 1

    Open Data Protection and select Log DSR

    In the left menu, open Data Protection and DSRs: the register of data subject requests. Select Log DSR. A form opens for the request.

    • Select Log DSR
  2. 2

    Fill in the request

    Choose the request type Access. Type the requester's name, Yasmin Tahiri, and her e-mail address, and set the date received to 22 October, 9:30 in the morning. Tick Identity verified and say how: the Emirates ID copy was checked against her Meridian Rewards account.

    • Select Select request type
    • Choose Access
    • Type Requester Name: Yasmin Tahiri
    • Type Requester Email: yasmin.tahiri@example.net
    • Type Received at: 2026-10-22T09:30
    • Select Identity verified
    • Type Identity verified at: 2026-10-23T08:00
    • Type Verification method: Emirates ID copy checked against the Meridian Rewards account
  3. 3

    Select Log DSR

    Select Log DSR at the foot of the form. The request appears in the register. Logging it is an event: Samira starts on it by herself.

    • Select Log DSR
    The screen at step 3: Select Log DSR
  4. 4

    See Samira start on the Work page

    In the left menu, under AI team, open Work. A goal about the new request appears with Samira as the agent. Nobody wrote to her: the event started it.

  5. 5

    Approve Samira's go-aheads under Needs you

    Samira asks before changing the request. Her go-ahead waits for you under Needs you, in the left menu, marked For: data protection officer: set the status to In progress, with notes giving the deadline, 21 November, 30 days from receipt, and the identity check. Select Approve. Samira starts the search of the data map, then sends a second go-ahead to add what the search found and her plan to the notes. Approve that too.

    • Select Approve
    • Select Approve
  6. 6

    Read Samira's handover

    Select Samira's goal. The panel shows her objective and, under Handover, the deadline: 21 November. The data-map search finished but covered no systems, because none are connected, so the empty result doesn't prove the company holds nothing; Samira names where Yasmin's data is likely held, the loyalty programme and the store CCTV, from the record of processing. Under For the checker to do are your steps: assign the request, collect the data from the loyalty processor and the stores, and send the reply before the deadline.

How to check it worked

Data Protection, DSRs lists Yasmin Tahiri's access request. On the Work page Samira's goal shows Handed over, and her handover gives the deadline and what is left for you. Samira repeats no personal data beyond what is needed, and the reply to Yasmin is yours to send.

Common mistakes

  • Logging the request without the date it was received. The deadline runs from that date.
  • Writing to Samira as well. Logging the request already started her work.
  • Letting the agent answer the person. The reply, and anything sent to the data subject, comes from the DPO.

Check your understanding

  1. 1. What starts Samira's work on a new access request?

    1. A.The request being logged in Data Protection
    2. B.An e-mail from the data subject to Samira
    3. C.A monthly schedule
    4. D.The administrator
    Show answer

    Answer: A. The request being logged in Data Protection

    Logging a data subject request is an event that starts the data protection agent.

  2. 2. From when does the deadline to answer run?

    1. A.From when Samira starts
    2. B.From the date the request was received
    3. C.From the end of the month
    4. D.There is no deadline
    Show answer

    Answer: B. From the date the request was received

    The law counts from receipt, which is why the received date matters when you log it.