Compliance | mvdm.io

Purpose

This Procedure describes how we receive, verify, and answer requests from people who exercise their rights over their personal data, within the time that Regulation (EU) 2016/679 allows.

Scope

It applies to every request about personal data that reaches Tidewell IT, through any channel, from staff, customer contacts, or other people, and to personal data we hold as controller or as processor.

Roles

Data Protection Officer: owns this Procedure, decides on each request, and answers it.
Service Desk Lead: logs requests and acknowledges them.
HR Lead: supplies data about staff.
All staff: forward a request the same day it arrives.

Procedure

Receive and log

Requests are received at privacy@tidewell-it.example. A request that reaches anyone else in the company is forwarded to that address the same day.
The Service Desk logs the request and acknowledges it within 3 working days.

Verify and decide the role

The Data Protection Officer verifies the identity of the requester, and asks for more information only when the identity is in doubt.
The Data Protection Officer decides whether Tidewell IT acts as controller or as processor for the data concerned.
When Tidewell IT is processor, the request is forwarded to the customer within 2 working days and the requester is told that we have done so.

Gather and assess

The Data Protection Officer gathers the data from the systems that hold it, with the help of the system owners.
Exemptions are applied where they hold, for example where the data of other people would be disclosed. Each exemption and its reason is recorded.

Answer

The answer is sent within one month of the request. For a complex request, the period can be extended by two months, if the requester is told of the extension and the reason in the first month.
The answer covers the right that was exercised: access, rectification, erasure, restriction, notification to recipients, portability, or objection.
For access, the answer gives a copy of the data with the purposes, recipients, and retention period.
For rectification, erasure, or restriction, the change is made in all systems, and recipients of the data are told of it.
For portability, the data is provided in a structured, common, machine-readable format.
For objection, processing stops unless there is a compelling legitimate ground that is explained to the requester.

Record

The Data Protection Officer records the outcome, the date of the answer, and any exemption used, and closes the log entry.

Records

The log entry with the request, the verification, and the decisions.
The answer sent and the date.
Records are kept under the retention schedule of the Information Classification and Retention Policy.

Review

The Data Protection Officer reviews this Procedure at least once a year and after a significant change.

Data Subject Request Handling Procedure