Free Terms & Privacy generator
Data-Subject-Request (DSR) Handling Procedure
An internal playbook for receiving, verifying, and answering privacy rights requests on time and on the record.
What is a Data-Subject-Request (DSR) Handling Procedure?
A Data-Subject-Request (DSR) Handling Procedure is an internal playbook for receiving, verifying, and answering privacy rights requests on time and on the record.
Any business whose Privacy Policy promises rights (access, delete, opt-out). Honoring them within the legal deadlines, and proving you did, takes a documented process.
Data-Subject-Request (DSR) Handling Procedure template, current for 2026
Covers the 2026 multi-state regime with unified intake for access/correction/deletion/portability/opt-out/appeal across CCPA and the VA/CO/CT-style laws, GPC signal handling, authorized-agent and appeal workflows, a GDPR/UK extension, and a logging standard so you can demonstrate compliance to a regulator. It is an operational tool as well as a policy.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Data-Subject-Request (DSR) Handling Procedure as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- Which organization does this procedure govern? This is the covered business/controller whose personnel must follow the playbook. Its legal name anchors every reference in the document.
- What is the effective date of this procedure? The date this playbook takes force. Used for version control and to fix which legal regime applies.
- What version or revision number should this document carry? Internal procedures are living documents; a version tag lets you prove which iteration was in effect when a request was handled.
- Who owns and maintains this procedure (the accountable role or person)? The Privacy Program owner accountable for keeping the playbook current and for oversight of the intake queue. Naming an owner is the on-the-record part of the purpose.
- What is the published privacy contact (email/phone/portal) where requests should land? The intake channels you disclose to the public. Requests received elsewhere still count, so staff need to know where to route them.
- Have you appointed a Data Protection Officer or equivalent privacy lead? Sets where the escalation ladder ends, with a named DPO or with the general privacy owner. It also affects a governance clause.
- Who is the Data Protection Officer / privacy lead? Names the individual to whom hard calls and cross-border matters escalate.
- Which U.S. state privacy laws does the organization treat itself as subject to? Rights, timelines, and appeal mechanics vary by state. This scopes which regimes the response tables must satisfy. The 2025-26 wave (Delaware, Iowa, New Jersey, New Hampshire, Nebraska, Maryland, Minnesota, Indiana, Tennessee, Rhode Island, Kentucky) is included with staggered effective dates.
- Does the organization handle personal data subject to the EU/UK GDPR? GDPR carries a distinct one-month clock and rights set. If in scope, the procedure adds a parallel workflow.
- Which data-subject rights will this procedure cover? The catalog of requests staff must recognize and route. Each supported right gets a handling row.
- How does the organization handle sensitive personal / sensitive data across your states? This is a material 2026 distinction. California uses an opt-out and limit model for sensitive personal information. Virginia, Colorado, Connecticut, and most 2023-26 laws require prior opt-in consent before processing sensitive data. Maryland's MODPA goes further, barring the sale of sensitive data and limiting its collection to what is strictly necessary. Getting this right drives Sections 3, 7, and 8.
- Will the organization conduct data protection assessments (DPIAs) for higher-risk processing? Colorado, Connecticut, Virginia, and most 2025-26 laws require a documented data protection assessment before processing that presents heightened risk, including targeted advertising, sale, profiling with legal or similarly significant effects, and processing of sensitive data. This adds an assessment cross-reference to the procedure.
- What is your standard substantive response deadline (in days)? Most U.S. state laws set 45 days. This is the outer clock for a substantive answer before any permitted extension.
- By how many additional days may a response be extended when reasonably necessary? Many laws allow one extension (commonly another 45 days) with notice. Sets the ceiling for complex requests.
- Within how many days must intake acknowledge receipt of a request? An internal SLA for confirming receipt so the requester and the record show prompt handling, well ahead of the legal deadline.
- What identity-verification standard applies to most requests? Verification rigor must scale to the sensitivity and risk of the request. This sets the baseline the intake team applies.
- Will you accept requests submitted by authorized agents on a consumer's behalf? California and others require honoring agent-submitted requests. Answer yes and an agent-verification sub-procedure is included.
- How many requests per consumer per year will you honor free of charge? Laws permit charging for or refusing only manifestly unfounded or excessive requests once a free allowance (often twice per 12 months) is used up. Sets the fee-policy trigger.
- List the key systems, data stores, and vendors that must be searched to fulfill a request. Fulfillment is only as complete as the search. Enumerating sources of record makes the procedure operational and auditable.
- Must service providers / processors be instructed to act on deletion and correction requests? Deletion/correction obligations typically flow to vendors under DPAs. Adds a downstream-propagation step to the workflow.
- How will responses and disclosures be delivered to requesters? Access disclosures contain personal data and must be delivered securely. Governs the transmission clause.
- For how many years will you retain the request/response log? State laws often require keeping request records for at least 24 months. That is a statutory floor, and you may keep them longer. Sets the audit-trail retention period.
- Will you offer an internal appeal process for denied requests? Several state laws require a consumer appeal mechanism. Answer yes and the appeal section is included.
- Within how many days must an appeal decision be issued? Appeal windows commonly run 45 to 60 days. Sets the appeal SLA.
- How often will staff who handle personal data be trained on this procedure? Training frequency evidences a maintained program. Sets the training covenant.
- Which U.S. state's law governs interpretation of this internal procedure? Internal governance documents name a home jurisdiction for interpretation, separate from the consumer-law regimes the procedure implements.
- Which categories of personal data does this procedure cover? Rights and exemptions differ by data subject population. Most state laws exempt data processed in an employment or B2B context (California no longer does). Selecting the applicable lanes adds a scope branch that routes consumer, employee/HR, and business-contact requests correctly.
- List any entity-level or data-level exemptions your organization relies on. Many state privacy laws carve out data governed by HIPAA, GLBA, FCRA, FERPA, or the Driver's Privacy Protection Act, along with nonprofit and entity exemptions. Listing them lets intake route exempt data out of the DSR workflow instead of guessing.
- Do you knowingly process personal data of minors, and if so under what regime? Minors' data triggers heightened obligations: COPPA for children under 13, opt-in consent for teens under 16 for sale/targeted advertising under most state laws, and state-specific age-appropriate design rules. This adds a minors branch to the assessment and escalation sections.
- Should the procedure cross-reference your incident/breach response plan? A DSR sometimes surfaces or coincides with a security incident (for example, an access request revealing unauthorized exposure). Linking the two means handlers escalate to the breach plan rather than resolving the request in isolation.
- Any organization-specific rules, exemptions, or escalation triggers to include? Captures bespoke carve-outs and escalation triggers so the playbook fits your actual data footprint.
Frequently asked
About the Data-Subject-Request (DSR) Handling Procedure and how HDAi works.
What is a Data-Subject-Request (DSR) Handling Procedure? +
A Data-Subject-Request (DSR) Handling Procedure is an internal playbook for receiving, verifying, and answering privacy rights requests on time and on the record. Any business whose Privacy Policy promises rights (access, delete, opt-out) needs one, because honoring those rights within the legal deadlines, and proving you did, takes a documented process.
Is HDAi's Data-Subject-Request (DSR) Handling Procedure legally binding? +
Not in the way a contract is. The Data-Subject-Request (DSR) Handling Procedure is a working document that organizes the facts and decisions the next step needs (an attorney's work, a filing, or a board decision), and it does not become binding by signature. Treat the output as preparation, and have a licensed Hart David Carson attorney finish whatever follows from it.
Do I need a lawyer to use this Data-Subject-Request (DSR) Handling Procedure? +
You can generate and download the Data-Subject-Request (DSR) Handling Procedure in minutes, free of charge. A licensed Hart David Carson attorney can then review it and tailor it to your facts before you sign, which is the part no template can do.
What makes this Data-Subject-Request (DSR) Handling Procedure current for 2026? +
Covers the 2026 multi-state regime with unified intake for access/correction/deletion/portability/opt-out/appeal across CCPA and the VA/CO/CT-style laws, GPC signal handling, authorized-agent and appeal workflows, a GDPR/UK extension, and a logging standard so you can demonstrate compliance to a regulator. It is an operational tool as well as a policy.
How long does the Data-Subject-Request (DSR) Handling Procedure take? +
Estimated time about 16 min (31 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Data-Subject-Request (DSR) Handling Procedure work in my state? +
HDAi's interview is state-aware. If you ask an attorney to finish the draft, a licensed Hart David Carson attorney confirms it against your state's requirements before you rely on it. Validity and required formalities vary by state.
Terms & Privacy
Related generators
Email & Marketing Consent (CAN-SPAM + Opt-In) · Website Privacy Policy (UK GDPR / DPA 2018) · End-User License Agreement (EULA) · Website Privacy Policy (Singapore, PDPA) · All 124 →