Managing privacy requests

Once privacy requests have been submitted, they must be reviewed.

The data subject's location determines the regulation that applies and with it, the time limit for when a privacy request must be completed. This table descibes some of the timeframes for common privacy regulations:

Exceptions

There are some situations where you may not be able to, or required to, complete a privacy request. It's important to know when these might apply and how to manage them. In each case you should evaluate the circumstances and risks for your specific organization to ensure you're complying at all times.

Legal obligation

There are certain categories of personal data that you may be required to retain in order to fulfill legal or compliance obligations. In such cases, you're permitted to retain that data in the event when an erasure request is received- provided you restrict the use of the data to that purpose.

Confidentiality risk

In circumstances where returning data to a subject might reveal confidential or sensitive information about any organization or another individual, you're not required to return that specific piece of information.

Privacy request statuses

Each privacy request is assigned a status that reflects its current stage in the workflow:

Reviewing privacy requests

When privacy requests are received, they're registered in Fides as a New request available to view in the Request Manager :

Approving a request

A privacy request can be approved from the Request Manager or from the details panel of the privacy request.

To approve a request from the Request Manager, hover over the kebab menu ... for the request and click Approve:

To approve a request from the request details page, click the Approve button:

After approval, the privacy request is processed using the configured Privacy Request Policy. When the request is complete, the data subject will be notified by email. If the request is an access request, the confirmation email will include a download link to retrieve a copy of their personal data.

Rejecting a request

To reject a request from the Request Manager, hover over the kebab menu ... for the request and click Deny:

To reject a request from the request details page, click the Deny button:

When rejecting a privacy request, you'll be prompted to provide a reason for the rejection. This reason is stored in the Fides audit trail for reporting purposes and also communicated to the subject via email.

Extending a request

Sometimes a request needs more time than its standard response window allows. You can extend a request's response deadline by a set number of days, along with a required reason for the extension. The Extend action is available for any request that has a due date and hasn't reached a completed, denied, or canceled status. Consent requests, which have no due date, can't be extended.

To extend a request from the Request Manager, hover over the kebab menu ... for the request. If the request can also be deleted, the two actions are combined into a single More actions menu, with the extend option labeled Edit request deadline:

To extend a request from the request details page, open the Actions menu and select Extend:

Either path opens the same dialog. Enter the number of days to extend the deadline by, and a reason for the extension:

If the subject's location maps to a regulation with a known extension allowance, the days field is pre-filled and capped to whatever's still available, and the dialog tells you which regulation applies. Today, Fides recognizes two such allowances:

• CCPA: up to 45 days total
• GDPR: up to 60 days total (an approximation of the "two further months" allowed under GDPR, rather than a calendar-accurate calculation)

This allowance is measured from the request's original due date, not its most recently extended one — so if a request is extended more than once, the extensions draw down the same allowance instead of each getting a fresh one. Requests from locations that don't map to a regulated allowance aren't capped.

The reason you provide is required, and is included in the notification email sent to the data subject if the deadline extension notification setting is enabled for your environment.

You'll see a warning — though you can still proceed — if:

• The request has already been extended once before.
• The request is already past its original response deadline.

Once confirmed, the new due date takes effect immediately, and an Extended tag appears next to the request — both in the Request Manager and on the request's details page:

Every extension is recorded in the request's audit trail.

Viewing request details

To view the details of a specific privacy request, click the kebab menu ... and select View Details:

The Privacy Request Details page displays:

• Request ID: The unique ID for the privacy request.
• Request Type: The privacy request type, such as access or erasure.
• Policy Key: The privacy request policy being applied to the privacy request.
• Status: The current status of the privacy request, including a countdown timer by when the request must be completed.
• Subject Identities: The related identifiers for the subject that made the request.
• Events Log: An activity log related to the privacy request.

Exploring the Request Manager

The privacy request admin panel features a set of controls to filter, search, and create reports.

Filtering requests

Privacy requests can be filtered by status or date range:

Each privacy request is assigned a uniquely identifiable Request ID and you can search for the request using this ID:

Reporting

To download a report of the currently filtered view of privacy requests click the Download button.

Revealing personal identifiers

To minimize personal data risks, obfuscates personal identifiers in the UI by default. To reveal personal identifiers, you can toggle the Reveal PII switch as shown: