/ Docs
Contents

Privacy requests

When a person asks you to show, correct, move or erase their data, to restrict or object to its use, or to stop sending them marketing, the GDPR gives you one month to answer. Compliance > Privacy requests is where you handle those requests: each has a reference, a deadline, an assignee, guided actions and a log of everything done, so you can always show what happened and when.

Requests from your website's privacy form, when it is connected to Brain, open on their own. Requests that arrive by email, certified email or phone, you open by hand.

Open a request

Steps

  1. In Nucleo, go to Brain > Compliance > Privacy requests.
  2. Click New request.
  3. In Email, enter the data subject's email address. It is required.
  4. Optional: enter the First name and Last name.
  5. In Type, select the kind of request (see the table below).
  6. In Language, select Italiano or English. The emails to the data subject use this language.
  7. Optional: in Source, write how the request arrived, such as email, PEC or phone.
  8. Optional: in Request text, paste what the person wrote.
  9. Click Open request.

The one-month deadline starts now. Brain looks for the contacts and companies that match the email, notifies the people who handle privacy, and opens the request so you can start working on it. If the same request was already opened in the last 10 minutes, Brain opens the existing one instead of a duplicate.

TypeWhat the person asks
AccessTo receive a copy of their data.
ErasureTo have their data deleted.
RectificationTo correct inaccurate data.
ObjectionTo stop a processing they object to.
RestrictionTo limit the use of their data while something is checked.
PortabilityTo receive their data in a format they can take elsewhere.
UnsubscribeTo stop receiving marketing.
OtherAnything else about their personal data.

Track requests and deadlines

At the top of Privacy requests, three counters show Open requests, requests Due within 20 days and Overdue requests. Below them, the page says who receives the privacy notifications: by default, Owners and Admins.

ColumnWhat it shows
ReferenceThe request's own reference.
Data subjectThe person's name and email, and the matched company.
Type and StatusThe kind of request and where it stands.
DeadlineThe deadline date, with the days left or how many days late. The badge turns amber within 20 days and red within 3 days or once overdue. Closed requests show Closed.
AssigneeWho is handling it.
ReceivedWhen it arrived.

The list opens on open requests. Use Filters to show All statuses or one status, and one type or All types. Search by email, reference or surname… finds a request. The people who handle privacy are also reminded as a deadline approaches.

Work a request

Click a request to open it. The panel shows its details (received date, deadline, source, language, the matched contact and company, or Not found in Brain, and the assignee) and the request text.

Steps

  1. In Nucleo, go to Brain > Compliance > Privacy requests, and then click the request.
  2. In Assignee, select the person handling it.
  3. In Status, move the request forward, and then click Apply.
  4. Optional: in Internal notes, keep notes on the request, and in Add to the log, write a step you took, such as a call or a check. Click Save.
  5. Use the guided actions the request needs (see below).
StatusWhat it means
ReceivedThe request has arrived and nobody has worked on it yet.
Identity checkYou are verifying that the request comes from the data subject.
In progressYou are carrying out the request.
CompletedThe request is done and the outcome was communicated.
RejectedThe request was refused, with the reason in the outcome.

Everything you do is written to the Log at the bottom of the panel, with the date and who did it. Steps Brain takes on its own, such as matching the contact or notifying the privacy group, are marked System.

Use the guided actions

Guided actions carry out the request on the data in Brain. Every action is explicit, done by a person and written to the log. The action that fits the request's type is highlighted.

ActionWhat it does
Unsubscribe from marketingWithdraws the marketing consent of every matched contact, in Brain and in connected marketing tools such as Klaviyo.
Restrict processing (art. 18)Marks the matched contacts as restricted. Lift restriction removes the mark.
Preview erasureLists what would be deleted, what would be anonymized or unlinked, and what is kept because the law requires it.
Export JSON (access)Downloads the person's data, for an access request.
Export CSV (portability)Downloads the person's data in a portable format.
Send acknowledgmentEmails the data subject to confirm you received the request.
Send extension noticeEmails the new deadline and its reason. Available once you have extended the deadline.
Send outcomeEmails the outcome. Available once you have written it.

The emails go out in the request's language. You can change their wording in Emails and notifications.

Erase a person's data

Steps

  1. Open the request, and then click Preview erasure in Guided actions.
  2. Read the Erasure preview: the contacts matched in Brain, what Will be deleted (such as activities, bookings and marketing sends), what Will be anonymised / unlinked (such as contacts, emails and calls) and what is Kept (legal retention) (such as contracts, accepted quotes and fiscal documents).
  3. Tick the box to confirm that you have verified the identity of the data subject.
  4. Click Confirm erasure — irreversible.
Caution
Erasure can't be undone. Check the identity of the person first: an erasure asked for by the wrong person deletes someone else's data.
Note
If no contact matches the email, Brain tells you there is nothing to erase in Brain. Data held in other systems still needs to be handled there.

Extend the deadline

The GDPR lets you extend the one-month deadline by up to two further months, with a written reason, when a request is complex.

Steps

  1. Open the request.
  2. In Extend until, pick the new deadline. It must fall after the original deadline and within two further months.
  3. In Reason, explain why you need more time. The data subject receives it.
  4. Click Extend.
  5. In Guided actions, click Send extension notice.

Close a request

Steps

  1. Open the request.
  2. In Status, select Completed or Rejected.
  3. In Outcome communicated to the data subject, write what was done and what was kept, and why. It is required to close the request.
  4. Click Apply.
  5. In Guided actions, click Send outcome.

The request shows the date it was closed and leaves the list of open requests. You find it again with the All statuses filter.

Related articles