FieldRegister
Every field · Consent, preferences and rights

Rights request or deletion flag

A record of a rights request (access, deletion, correction) is itself evidence for CPRA recordkeeping (CCR 7101) and GDPR Art. 12.

personal data
personal data?
standard
sensitivity
usable
AI use
legal obligation
lawful basis usually relied on

Keep it how long

For the request record: the limitation period. The data it concerns: as the request requires.

The gap we see most

Deletion handled by anonymising the name and leaving the rest of the record intact.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Rights requests GDPR Art.12 · GDPR Art.15 · GDPR Art.17 · CCPA/CPRA §1798.105(c) · CCPA/CPRA §1798.130(a)(2) · ISO/IEC 27701:2019 7.3.9
GDPR Art.12 Transparent information, communication and modalities for rights

Provide the Article 13 and 14 information and every Article 15 to 22 and 34 communication in a concise, transparent, intelligible and easily accessible form, in clear and plain language, with particular care where the information is addressed to a child, normally in writing including by electronic m...

Evidence an auditor accepts: The request register showing receipt date, response date, and any extension with its notification and stated reasons; Readability evidence for the privacy information, such as a plain language review or a reading age assessment; The identity verification standard applied, with the reasoning that it is proportionate rather than routine
GDPR Art.15 Right of access by the data subject

On request, confirm whether personal data concerning the data subject is being processed and, where it is, provide access to that data together with the purposes, the categories of personal data, the recipients or categories of recipient including any in third countries or international organisation...

Evidence an auditor accepts: The search methodology showing every system, archive and unstructured store searched, and how completeness was assured; A worked response covering all the supplementary information items, not only the copy of the data; The redaction position and the applied redaction log where third party data was withheld, with a reason recorded per redaction
GDPR Art.17 Right to erasure (right to be forgotten)

Erase personal data without undue delay where the data is no longer necessary for the purposes it was collected or processed for, where consent is withdrawn and no other legal ground applies, where the data subject objects under Article 21(1) and there are no overriding legitimate grounds or objects...

Evidence an auditor accepts: Erasure records showing the ground relied on, the decision, and the date the data actually left each system; A deletion capability map covering production, replicas, warehouses, logs, search indexes, backups and processors, with method and lag for each; Where an exemption is applied, the specific Article 17(3) ground and the necessity reasoning for the data actually retained
CCPA/CPRA §1798.105(c) Delete on a verified request and pass deletion on

On a verifiable deletion request a business must remove the consumer's personal information collected from that consumer, direct each service provider and contractor to erase it, and tell every third party that bought or received it to delete it unless that is impossible or involves disproportionate...

Evidence an auditor accepts: Deletion procedure covering production systems, analytics stores and service provider copies; Deletion instructions sent to service providers, contractors and third parties with confirmations; Register of retention exceptions applied, with the legal basis for each kept data set
CCPA/CPRA §1798.130(a)(2) Answer verified requests within 45 days, free of charge

A business must deliver the required information, make the correction or carry out the deletion free of charge within 45 days after a verifiable request arrives, starting verification promptly without stopping the clock. It may extend once by a further 45 days where reasonably needed if it tells the...

Evidence an auditor accepts: Request log with received date, verification date, response date and any extension notice; Service-level report of response times against the 45-day limit; Template response letters and extension notices
ISO/IEC 27701:2019 7.3.9 Handling requests

The organization must define and document policies and procedures for handling and responding to legitimate requests from individuals, which can include requests for a copy of data or to lodge a complaint, handling them within appropriate defined response times, taking account of jurisdictions that ...

Evidence an auditor accepts: Documented request handling procedure covering identification, triage, response and escalation; Response times published in the privacy policy and measured in operation; Delay notification procedure and evidence of use

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Opt-out, do-not-contact or unsubscribe flag · Call recording or transcript