Data Subject Requests (ARCO)
This workshop prepares the organisation to handle requests from people exercising their rights: intake channels, identity verification, a clear procedure and an end-to-end test.
Workshop 7 video
Walkthrough of the workshop and its tasks — coming soon
Workshop tasks
-
1. Rights & deadlines
List which rights apply and the deadlines for responding. Record the deadlines in the procedure and in ResGuard.
-
2. Intake channels & verification
Define channels (web form, dedicated email, post), make sure requests received elsewhere are forwarded immediately and define proportionate identity checks.
-
3. Handling procedure
Document the steps: log and acknowledge, verify identity, search all systems using the RoPA, respond, document refusals and close.
In ResGuard: Policy Framework -
4. Manage requests in ResGuard
Log every request with type, requester and date received, and track each step so no deadline is missed.
In ResGuard: Requests -
5. End-to-end test
Simulate an access request, run through the full procedure and time each step against the legal deadline.
In ResGuard: Requests -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Peru
- In Peru these are known as ARCO rights: access, rectification, cancellation and objection, plus the right to information and other rights under the law.
- Response deadlines are counted in business days and differ by right. Take them from the Regulation in force.
- Exercising these rights is free of charge. If a request is refused or not answered, the data subject can turn to the ANPDP through a protection procedure.
Expected result
- Overview of rights and deadlines documented
- Intake channels and identity verification defined
- Procedure approved in the Policy Framework
- Requests managed in the Requests module and test completed
ResGuard modules: Requests, Policy Framework