7.3.9 Handling requests
The organization must define and document policies and procedures for handling and responding to legitimate requests from individuals, which can include requests for a copy of data or to lodge a complaint, handling them
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Complaint route distinct from general customer service, with records · Document repository
governing documentDocuments that govern the control
- Documented request handling procedure covering identification, triage, response and escalation · Policy repository / GRC workspace
- Response times published in the privacy policy and measured in operation · Policy repository / GRC workspace
- Delay notification procedure and evidence of use · Policy repository / GRC workspace
- Fee policy where a fee is charged, with the justification for each charge · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Requests handled through general customer service with no privacy specific triage, so clocks start late
- Response times published but not measured, so breaches are invisible
- No delay notification, so a complex request simply goes quiet
- Complaints resolved individually with no analysis of the systemic cause
- Identity verification demanding more personal data than the request itself involves
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.3.8 Providing copy of PII processed · 7.3.10 Automated decision making