:root{--green:#2F7D43;--green-dark:#276B38;--green-light:#EAF3EC;--green-mid:#B5D9BD;--green-xlight:#F1F5F2;--accent:#2F7D43;--slate:#12201A;--blue:#176B87;--danger:#B42318;--text:#000;--text-2:#34423B;--border:#DCE3DF;--bg-light:#F6F8F7;}
.cfy-page *{box-sizing:border-box;}
.cbp{margin:0;font-family:"Outfit",sans-serif;color:#000;line-height:1.7;}
.cbp .wrap{max-width:820px;margin:0 auto;padding:0 24px;}
.cbp h1, .cbp h2, .cbp h3{font-family:"Outfit",sans-serif;font-weight:700;color:var(--slate);line-height:1.25;}
.cbp-hero{background:linear-gradient(170deg,#fff 55%,var(--green-xlight) 100%);padding:64px 0 44px;}
.cbp-cat{display:inline-block;font-size:11.5px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--green);background:var(--green-light);border:1px solid var(--green-mid);padding:5px 13px;border-radius:100px;margin-bottom:16px;text-decoration:none;}
.cbp-hero h1{font-size:38px;margin:0 0 14px;}
.cbp-meta{font-size:13.5px;color:var(--text-2);}
.cbp-body{padding:44px 0 20px;}
.cbp-answer{background:var(--bg-light);border-left:4px solid var(--green);border-radius:10px;padding:20px 24px;margin:0 0 30px;}
.cbp-answer strong{display:block;font-family:"Outfit",sans-serif;color:var(--slate);font-size:14px;margin-bottom:6px;text-transform:uppercase;letter-spacing:.05em;}
.cbp-answer p{margin:0;font-size:16.5px;color:#000;}
.cbp-toc{border:1px solid var(--border);border-radius:10px;padding:18px 24px;margin:0 0 32px;background:#fff;}
.cbp-toc h2{font-size:14px;margin:0 0 10px;text-transform:uppercase;letter-spacing:.05em;color:var(--text-2);}
.cbp-toc ol{margin:0;padding-left:20px;}
.cbp-toc li{font-size:14.5px;margin-bottom:5px;}
.cbp-toc a{color:var(--green);text-decoration:none;font-weight:600;}
.cbp-body h2{font-size:25px;margin:36px 0 12px;}
.cbp-body h3{font-size:18px;margin:26px 0 8px;}
.cbp-body p{font-size:16.5px;color:#111;margin:0 0 16px;}
.cbp-body ul, .cbp-body ol{margin:0 0 18px;padding-left:22px;}
.cbp-body li{font-size:16px;color:#111;margin-bottom:8px;}
.cbp-key{background:var(--green-xlight);border:1px solid var(--green-mid);border-radius:10px;padding:20px 24px;margin:28px 0;}
.cbp-key h3{margin:0 0 10px;font-size:15px;text-transform:uppercase;letter-spacing:.05em;color:var(--green-dark);}
.cbp-key ul{margin:0;padding-left:20px;}
.cbp-key li{font-size:15.5px;color:#111;}
.cbp-warn{background:#fef2f2;border-left:4px solid var(--danger);border-radius:10px;padding:18px 24px;margin:24px 0;}
.cbp-warn h3{color:var(--danger);font-size:15px;margin:0 0 8px;}
.cbp-warn li, .cbp-warn p{font-size:15.5px;color:#B42318;}
table.cbp-t{width:100%;border-collapse:collapse;margin:22px 0;font-size:15px;}
table.cbp-t th, table.cbp-t td{border:1px solid var(--border);padding:11px 14px;text-align:left;vertical-align:top;}
table.cbp-t th{background:var(--bg-light);font-weight:700;color:var(--slate);}
.cbp-faq{margin:38px 0 0;border-top:2px solid var(--border);padding-top:26px;}
.cbp-faq h2{margin-top:0;}
.cbp-q{border-bottom:1px solid var(--border);padding:16px 0;}
.cbp-q h3{margin:0 0 6px;font-size:16.5px;}
.cbp-q p{margin:0;font-size:15.5px;color:var(--text-2);}
.cbp-related{background:var(--bg-light);border-radius:12px;padding:24px;margin:34px 0 0;}
.cbp-related h2{font-size:17px;margin:0 0 12px;}
.cbp-related ul{margin:0;padding-left:20px;}
.cbp-related li{font-size:15.5px;margin-bottom:7px;}
.cbp-related a{color:var(--green);font-weight:600;text-decoration:none;}
.cbp-cta{background:var(--green);border-radius:14px;padding:34px;text-align:center;margin:38px 0 10px;}
.cbp-cta h2{color:#fff;font-size:23px;margin:0 0 8px;}
.cbp-cta p{color:#EAF3EC;font-size:15.5px;margin:0 0 18px;}
.cbp-btn{display:inline-block;background:#fff;color:var(--green-dark);font-weight:700;padding:13px 26px;border-radius:8px;text-decoration:none;font-size:15px;}
.cbp-btn:hover{background:var(--green-xlight);color:var(--green-dark);}
@media(max-width:760px){.cbp-hero h1{font-size:28px;}.cbp-body h2{font-size:21px;}table.cbp-t{font-size:13px;}}
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Can we charge for a request?","acceptedAnswer":{"@type":"Answer","text":"Generally no. A reasonable fee is permitted only for manifestly unfounded or excessive requests, or for additional copies."}},{"@type":"Question","name":"Do we have to search backups?","acceptedAnswer":{"@type":"Answer","text":"Backups are in scope in principle. Regulators accept proportionate approaches where restoration is disproportionately difficult, but you must be able to explain your reasoning."}},{"@type":"Question","name":"What if the request comes through support?","acceptedAnswer":{"@type":"Answer","text":"It still counts and the clock still starts. Train front-line staff to route requests immediately rather than answering them ad hoc."}},{"@type":"Question","name":"Can we refuse an erasure request?","acceptedAnswer":{"@type":"Answer","text":"Sometimes. If you have a legal obligation to retain the data or another lawful ground overrides, you may refuse, but you must explain why."}}]}
GDPR
GDPR data subject requests: a workflow that actually works
Short answer
A data subject request must be answered within one month, extendable by two months for complex cases if you notify the person in time. The workflow that works has four stages: intake and identity verification, discovery across systems, review and redaction, then response and logging.
The rights you must service
- Access: a copy of their personal data and supporting information
- Rectification: correction of inaccurate data
- Erasure: deletion where a valid ground applies
- Restriction: pause processing while a dispute is resolved
- Portability: structured, machine-readable export
- Objection: to processing based on legitimate interests or direct marketing
A four-stage workflow
- Intake: a single monitored channel, with the clock started and logged on arrival
- Verify identity proportionately, without demanding excessive documentation
- Discovery: query every system in your data map, including backups and third-party processors
- Review: redact other people's personal data and genuinely privileged material
- Respond in a usable format and log what was provided, when and by whom
Where the month disappears
Common time sinks
- No single intake channel, so the request sits in someone's inbox for two weeks
- No data map, so discovery becomes an open-ended engineering hunt
- Processors who are slow to respond because the DPA sets no SLA
- Redaction done manually with no template or precedent
Reducing cost per request
The two structural fixes are a current data map and processor DPAs that commit vendors to assist within a defined window. Beyond that, build a repeatable export routine for the most common request type rather than treating each as bespoke.
Key takeaways
- One month to respond, extendable by two for complex requests.
- A single intake channel starts the clock reliably.
- Discovery is only as fast as your data map.
- Log every request and response as evidence.
Frequently asked questions
Can we charge for a request?
Generally no. A reasonable fee is permitted only for manifestly unfounded or excessive requests, or for additional copies.
Do we have to search backups?
Backups are in scope in principle. Regulators accept proportionate approaches where restoration is disproportionately difficult, but you must be able to explain your reasoning.
What if the request comes through support?
It still counts and the clock still starts. Train front-line staff to route requests immediately rather than answering them ad hoc.
Can we refuse an erasure request?
Sometimes. If you have a legal obligation to retain the data or another lawful ground overrides, you may refuse, but you must explain why.
Get audit-ready in 8 to 12 weeks
Certifyi pairs the platform with a named compliance lead, with transparent, scope-based pricing.
Book a readiness call Start the free self-assessment