When somebody asks to see, correct, delete or move their personal data, or asks you to stop using it, log it as a privacy request. The record shows when they asked, who checked their identity and how, where you looked, and what you told them.
Who can do this
An owner, editor or contributor of your workspace can log and answer requests. A viewer can see them.
Logging a new request needs a paid plan. On the free plan, requests already recorded stay visible, searchable and exportable.
Find the register
Open Records & controls → Privacy requests.
The figures at the top are Open right now, Past your target, Answered in and Answered inside it. Below them are the tabs Open, Past your target, Just arrived, Waiting on them, Answered and All, and chips to filter by type: Everything, Deletions, Copies, Stop using it and Other.
There is no 30-day countdown
The Act requires an answer without undue delay and sets no number of days. Asiri does not count one down. The register shows how long each request has been open, counted from the day the person asked.
If your workspace has its own service target, a request shows how close it is to that target, or how far past it. With no target, a request shows only its age, and nothing is marked overdue.
Log a request
Press Log a request. There are four steps.
- What they want. Choose one of the eight rights, for example Wants to see it, Wants it deleted, Wants it corrected or Wants us to stop. The rail lists what that right obliges you to do.
- Who is asking. Search the people index by name or reference and pick the person. If nobody matches, press Add them to the people index, or Log it without a person and link them later. Nothing can be sent until you know who asked.
- How it arrived. Choose How it came in and the Date they asked. Use the date they asked, not the date it reached you. Then answer Have you checked it is really them? with Yes, checked, Asked, waiting on them or Not yet. If checked, say What you checked.
- What it involves. The systems your register says hold this person's data. Asiri does not search them. It has no way into your systems.
Check the summary under Review before logging, then press Log it. The request gets a reference. Press Open the request.
Work through the request
The request page lists the work in order. The current step is open.
- It arrived. Already done.
- Tell them you have it. Edit the letter and press Tell them it arrived. Leave the address empty to record a letter you sent another way.
- Make sure it is really them. Choose or describe how you checked, say why that was enough, and press It is them — carry on. This comes before any answer, because answering discloses their data.
- Look everywhere their data might be. For each system, press Record what you found, then choose It holds their data, Nothing there or Could not search it. If it holds their data, say It can be deleted or It has to be kept, and name what requires it to be kept. The person will be told that reason.
- Answer them, and close it. Press Write the answer.
For an access or portability request, you can also record a data pack in JSON, CSV or XML. A PDF is not accepted, because it is not machine-readable.
Write the answer
Under The answer, choose What is true of it:
- Done in full
- Done in part
- Refused
- They withdrew it
- Not our data
Done in part and Refused need a reason, which goes to the person and onto the register. If you are keeping data under a retention obligation, name the rule under Retention rule relied on, if any.
Write The letter to them. If any system could not be searched, say so. Then press Send the answer, or Record the answer if you left the address empty. A request has one answer. After that you can still write to them or record a reply.
More time, letters and replies
On the same page:
- Take the one extension. Press More time is needed, give the reason and the letter. There is one extension per request, and the person is told.
- Write to them. A question or an update. It answers nothing and closes nothing.
- Record a reply that arrived. Asiri does not read your inbox, so add their replies yourself and say How it reached us.
Everything written or recorded appears in the rail under What has been said.
Common questions
"Does Asiri search our systems for the person's data?" No. It lists the systems your register says to check. What you record is what you found.
"Can we answer before checking identity?" The screen warns you, and the record shows the order things happened in. Check first.
"Can we still answer requests if our bill is unpaid?" Yes. Statutory registers, including requests, stay writable when a workspace is read-only.