Handle privacy requests (DSARs) on time
How should a small business handle data subject access and deletion requests?
Give people one place to ask, confirm the request really comes from them, start the legal clock (one month under GDPR, 45 days under CCPA/CPRA), check every system that holds their data, reply clearly, and keep a record of each step. Privara's request workflow does all of this, with a person approving every reply.
Intake
- A hosted form you link from your privacy policy: access, deletion, correction, or opt-out of sale or sharing.
- An email confirmation link before the request opens (CCPA opt-outs open straight away, because the regulations don't allow verifying them).
- Requests that arrive by email or phone can be recorded by hand.
Deadlines
- GDPR and UK GDPR: one month by default, extendable by up to two more with a reason.
- CCPA/CPRA: 45 days, extendable once by 45; opt-outs of sale or sharing: 15 business days.
- Your own regime in days, and whether the clock starts at receipt or at confirmation.
- Daily reminders for requests due soon or overdue.
The work and the reply
- A task per confirmed system in your data inventory, with your own instructions for finding, exporting or erasing data there.
- Replies drafted from your templates, optionally tidied by AI; drafts with unfilled [brackets] can't be approved.
- An admin approves, then presses Send. Nothing goes to the requester before that.
- A timeline of every step, and requester details encrypted at rest.
Which plan
The request workflow is on Business ($79 a month) and Pro ($149), each with a 7-day free trial. Privara is not legal advice. It reports what a browser saw and helps you organize the work; you and your advisers decide what applies and whether you comply.