A privacy-request inbox that staff can hand over safely
Share
Published
A privacy request can arrive through customer support, an employee’s email or a conversation at the counter. A reliable intake process recognises the request, gives it an owner and keeps enough information for a colleague to take over safely.
The process below is a practical companion to the privacy operations guide. It does not set a universal response deadline or decide which rights apply to a particular request. Record those requirements at intake with the person responsible for privacy advice.
Recognise the request before debating the label
“My delivery address is wrong” may be an ordinary correction that support can handle. “Tell me what information you hold about me” needs a different route. Staff should recognise both without requiring the customer to quote an Act or complete an unfamiliar legal form.
Ask staff to forward or log the request through the approved route, rather than copying the customer’s full record into a team chat. Record the original wording and when the organisation received it. If the person uses more than one channel, connect the records so two staff members do not send conflicting answers.
Use a small intake record
| Field | What to record |
|---|---|
| Reference | A unique request number |
| Received | Date, time and channel |
| Request | The person’s wording and any clarification |
| Contact | The approved reply route |
| Owner and deputy | Who handles the request and absence cover |
| Verification | The check required and its completion status |
| Deadline | The applicable requirement and who confirmed it |
| Progress | Systems checked, outstanding questions and next action |
| Closure | Decision, approval and evidence of delivery |
Keep this register accessible only to people who need it. Store sensitive supporting material separately with appropriate restrictions. A request reference should help locate evidence without embedding that evidence in every status report.
Verify the person proportionately
Sending account information to the wrong person would create another privacy problem. At the same time, demanding a full identity-document scan for every minor correction can collect unnecessary information.
Use a verification process suited to the request, relationship and risk. Record why the check is appropriate and who may decide that more information is needed. If someone acts for another person, verify the authority relevant to that request. Do not assume a shared surname or a familiar phone number settles it.
Search the process, not just the main database
The customer-data register should identify relevant systems, operational copies and suppliers. Ask each responsible owner for a controlled response. Avoid emailing a broad request for “everything about this person” to people who would not otherwise need to know about it.
Check whether the material includes other people’s information, confidential material or an issue requiring specialist review. Record the decision and reasoning instead of silently removing a difficult item or promising disclosure before the review is complete.
Make absence cover a real handover
A useful handover says what has been confirmed, what remains unknown and who owes the next response. “DPO handling” is not enough if that person is away. The deputy needs the reference, applicable deadline, approved contact route and access to the current evidence.
Keep factual status separate from a proposed outcome. For example: “The dispatch export has been located; the courier response is outstanding.” That is clearer than marking the whole request complete because one system search finished.
Close the loop and retain the right evidence
Record who approved the response, how it was delivered and any follow-up promised. Review the intake and supporting records under the organisation’s applicable retention rules. An audit trail does not require keeping every copied identity document indefinitely.
The NDPC’s own access-request form illustrates the distinction between supplying personal information and considering retention or other people’s rights. Its published response target describes that service; it should not be treated as the answer to every organisation’s timing question.
What should a small team test first?
Run a fictional access request while the normal owner is unavailable. Check whether the deputy can identify the deadline, find the process owner and prepare a response without opening unrelated customer records. Fix the first point where the handover fails, then repeat the exercise.
Featured image: AI-generated conceptual illustration.
