BlogData subject requests
A visitor asked you to delete their data. You have 30 days
You can extend once, if you tell them why before the 30 days end
Article 3 of the regulations gives you 30 days to carry out a request. If it takes unusual effort, or many requests arrive at once, you can extend once by up to 30 days. You tell the person, and why, before the first period ends.
Withdrawing consent is faster. You stop the processing it covered without unjustified delay, not on day 30.
Note the day it arrived
The clock starts the day you receive the request. Keep it as it came, even if it was spoken. Every request goes in your log.
Check who it is, then act
Confirm the requester is the person, or their guardian, with what you already have. Usually that is the email on the order. Do not ask for documents you do not need.
- Copy. Give them their data in a clear form, free of charge
- Correction. Fix it, and tell anyone you shared it with
- Deletion. Destroy it everywhere, backups included, and ask the parties you shared it with to do the same. If another law says to keep something, like an invoice, keep it and say how long
If you cannot finish in time
Extend once, before the deadline, with a reason. You may refuse a request that repeats without cause or needs extraordinary effort, but give the reason.
If you miss the deadline or refuse without cause, the person can complain to SDAIA within 90 days (article 36 of the regulations).
References
