Data subject rights

Data subject rights

Access, rectification, erasure, objection, portability, and restriction of processing, along with automated decision-making.

Handling procedure

A defined channel to receive requests and a maximum one-month deadline to respond.

Identity verification

Verifying the requester's identity before handling the request, to prevent unauthorized access.

What an auditor usually asks for

• Rights-handling procedure documented
• Request channel accessible to data subjects
• Log of requests received and their response deadline
• Identity verification procedure defined

How to cover this block in Kimobox

1. 1Log each data subject rights request as a record with its response deadline.
2. 2Document the identity verification procedure as a controlled document.
3. 3Track compliance with the one-month deadline from the dashboard.

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

1. Regulation (EU) 2016/679, General Data Protection Regulation EUR-Lex · Applicable since 25 May 2018
2. Organic Law 3/2018 on Data Protection and guarantee of digital rights BOE-A-2018-16673 · 6 December 2018
3. Spanish Data Protection Agency AEPD · Supervisory authority