Access & Correction Requests
This workshop prepares the organisation to handle requests from individuals who want to access or correct their personal data: intake channels, identity verification, a clear procedure and an end-to-end test.
Workshop 7 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Your own Request Portal: an online intake channel for each entity, with spam protection, e-mail verification of the requester and an automatic reference number
- Every request in one register, from receipt to closure
- Response times tracked automatically: each request shows how long it has been open and turns orange and red well before the deadline
- Daily e-mail notifications as long as a new request has not been taken on
- Template for the request handling procedure
Workshop tasks
-
1. Rights & timelines
The requests individuals can make and their response timelines are predefined in ResGuard: every request shows how long it has been open and warns you well before the deadline.
In ResGuard: Requests -
2. Intake channels & verification
Use your ResGuard Request Portal as a compliant intake channel: individuals submit requests online, confirm their e-mail address and receive a reference number automatically. Requests received by e-mail or post go into the same register.
In ResGuard: Request Portal -
3. Handling procedure
Document the steps: log and acknowledge, verify identity, search all systems using the inventory, respond, document refusals and close.
In ResGuard: Policy Framework -
4. Manage requests in ResGuard
Every request is registered with type, requester and date received. ResGuard tracks each step and notifies you daily about new requests, so no timeline is missed.
In ResGuard: Requests -
5. End-to-end test
Simulate an access request, run through the full procedure and time each step against the timeline.
In ResGuard: Requests -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- An access request covers the personal data and information about how it has been used or disclosed within the year before the request.
- Respond as soon as reasonably possible. If you cannot respond within 30 days, inform the individual in writing within 30 days of when you will be able to respond.
- A reasonable fee may be charged for access requests, but not for correction requests. Corrected data must also be sent to the organisations it was disclosed to in the past year, where needed.
Expected result
- Overview of requests and timelines documented
- Intake channels and identity verification defined
- Procedure approved in the Policy Framework
- Requests managed in the Requests module and test completed
ResGuard modules: Requests, Policy Framework