PDPL: requests, erasure, consent and complaints

Interactive tutorial

Follow the course step by step in the interactive player.

Lessons

1. 1Find your way around requests, consent and complaintsKnow where each part of this course lives inside Data Protection: the request list, the public request portal, erasure, consent, the suppression list and complaints, and what each one looks like before anything has been recorded.5 min
2. 2Set up the public request portal: every settingOpen a public web page where customers and staff can ask to see, correct or delete their personal data. You will go through every setting on the Request portal section: the page address, the requests you offer, identity documents, agents, your wording in English and Arabic, the language the page opens in, the safety limits and the acknowledgement email.8 min
3. 3Set the notices to requesters and preview the public page in English and ArabicSet the emails a requester receives when a request is completed, rejected or extended, then open the public page as a visitor sees it, in English and in Arabic, and see how the setting Language the page opens in changes what a new visitor gets.7 min
4. 4See what a member of the public does on the portalFollow the public request page from the visitor's side, field by field, so you can explain it to customers and front-line staff, and know where an attempt that was never confirmed shows up in ComplianceOS.7 min
5. 5Log a request received by phone or email: every fieldRecord a data subject request that did not come through the portal, field by field, so the response deadline starts counting from the moment the request really arrived.6 min
6. 6Log a request made by a parent for a child, with identity already checkedRecord a request that a parent makes about their child's data, including how you checked the parent's identity and their relationship to the child, so the record shows you verified both before acting.5 min
7. 7Assign requests to people and find them with the filtersGive each open request an owner, so that it appears in that person's My Actions list, and use the filters above the list to find requests by owner, by deadline and by where they came from.6 min
8. 8Pick up a request assigned to you and record the identity checkFind a request a colleague assigned to you in My Actions, open it, and record that you have started work and how you confirmed who the requester is.5 min
9. 9Answer an access request: search for the person's data, respond and closeTake a request from In progress to Completed: search the connected systems for the person's records, record what you sent them, close the request, and check the notice that goes to the requester.6 min
10. 10Extend a deadline, uphold an objection, reject a request, void a duplicate and export the logHandle the cases that are not a simple answer: give yourself more time once and say why, complete an objection, refuse a request with the legal reason, remove a record that was entered by mistake, and download the request log.8 min
11. 11Prepare for erasure: record a system and set the erasure safeguardsRecord a system that holds personal data on the Data map, then go through every safeguard on the Erasure section: the switch that pauses all erasure, the list of systems that may be erased with each system's settings, and the limits that stop a mistake from spreading.8 min
12. 12Handle an erasure request: search, plan, dry-run and submit for approvalWork a request to delete someone's data safely: search for the person's records, build the erasure plan from the search, run a dry-run that changes nothing, read the evidence trail, and send the plan to a second person for approval.7 min
13. 13Approve an erasure plan and execute itFind an erasure plan a colleague sent for approval, check it, approve it, and carry it out with the typed confirmation, so that you understand every safeguard between a request and the moment data is erased.6 min
14. 14After the erasure: the confirmation letter, the evidence, the suppression entry and closing the requestFinish an erasure request properly: read the confirmation prepared for the requester in English and Arabic, read the evidence trail of the plan, find the suppression entries the erasure created, and close the request.6 min
15. 15Place a legal hold from an erasure requestStop a person's records from being erased when a dispute requires them to be kept: place a legal hold from the erasure request, cancel the erasure plan, refuse the request with the reason, and find the hold in the legal-hold register.6 min
16. 16Use the legal-hold register: add a hold for one person and release itAdd a legal hold from the register without an erasure request in front of you, choosing what it applies to and picking the person from the searchable list of requests, then open a hold, release it when it is no longer needed, and find released holds again.6 min
17. 17Define what you ask consent for: consent purposesSet up the purposes for which your organisation asks people's consent, each with the exact wording people agree to and its version, mark the ones that are direct marketing or need explicit consent, change the wording of a purpose properly, and switch off a purpose you no longer use.7 min
18. 18Record a person's consent: every field, then find it againRecord one person's consent against a purpose, field by field, so that you can prove later what they agreed to, when and how. Then read the record, and find it again with the status filter, the search and the download.8 min
19. 19Record consent given by a parent for a child, correct a record, and read expired consentsRecord a consent that a parent or guardian gives for a child, with who they are and how you verified them, correct the age band on a record with a reason, and understand what Expired means in the register.7 min
20. 20Record a withdrawal of consent: one person, and several at onceRecord that a person has withdrawn their consent, withdraw several consents in one go, and confirm that each person was added to the suppression list so they are not contacted again.6 min
21. 21Use the suppression list: check, add, find, download and liftCheck whether a person may be contacted before a campaign, add someone to the suppression list by hand, find entries with the filters, give the marketing team the list to exclude from their sends, and lift an entry when a block no longer applies.8 min
22. 22Log a privacy complaint, record your response and close itRecord a privacy complaint from a customer with every detail, link it to the request it is about, track when the response is due, update it when more information arrives, record what you replied, and close it.8 min
23. 23Log a regulator enquiry, track its deadline, void a duplicate and export the registerRecord a letter from the data protection regulator with its reference and the deadline it sets, link it to the related request, move the deadline when the regulator changes it, remove a duplicate entry, and download the register.7 min
24. 24What someone without privacy access seesRecognise what a colleague outside the privacy team sees when they try to open requests, consent or complaints, so you can tell a missing permission from a fault and know who to ask.3 min
25. 25How this connects, part 1: what one request sets in motionFollow one request through the rest of ComplianceOS: the owner you give it, the warnings on the Data Protection overview and the dashboard, the approval record of an erasure plan, and the suppression entries and complaint that point back to requests.6 min
26. 26How this connects, part 2: the assignee's My ActionsSee, from the side of the person who was given a request, how it arrives in My Actions with its deadline, how it sits beside work from other modules, and how to get from there to the request.4 min
27. 27How this connects, part 3: request deadlines in the calendar, on the dashboard and in the evidence vaultSee where the privacy team's request deadlines appear for the rest of the organisation: in the compliance calendar after a sync, among the dashboard's upcoming deadlines, and as sealed evidence in the evidence vault when a request is closed.5 min
28. 28How this connects, part 4: the audit-log trail and read-only accessRead the trail that every action in this course left in the audit log, filter it to one kind of record, open the details of an event, and see what the request list looks like to someone who may view but not change it.6 min

How this connects to the rest of ComplianceOS

• Data map

  The search for a person's records, and automated erasure, work on the systems connected on the data map. A system recorded by hand is listed under Systems that may be erased as a work order for its owner, but it is not searched.

• My Actions

  A request assigned to you appears in your My Actions list with its status, priority and current due date, and leaves the list when it is completed or rejected. Open on the line takes you straight to the request.

• Approvals

  An erasure plan sent for approval appears in the approvers' inbox and under My requests for the person who sent it. The person who prepared the plan cannot approve it.

• Suppression list

  A withdrawn consent, a completed objection request and an executed erasure each add the person to the suppression list by themselves, with the source shown on the entry.

• Marketing tools

  The suppression list is downloaded as a file and loaded into campaign tools as an exclusion list. This section does not send it to them.

• Dashboard

  The entity dashboard counts open data subject requests under Needs attention for everyone who works on the entity, and lists request deadlines under Upcoming deadlines for people who can see the compliance calendar.

• Compliance calendar

  Request response dates appear in the compliance calendar as DSR Response entries after a sync, without the requester's name. A closed request shows Completed, a rejected one included, and a voided request shows Waived.

• Evidence vault

  Each request that is completed or rejected leaves a sealed DSR Response record in the evidence vault.

• Audit log

  Every action in these sections is recorded in the audit log with who did it and when: requests, assignments, searches, erasure plans, legal holds, consents, suppression entries, complaints and portal settings.

• Tax and finance

  Erasure settings let you mark tables that hold tax or accounting records, which are kept for the tax retention period. This takes effect only for a connected system and was not exercised in this example.