RCMIntake
The channels requests arrive through (form, email, post, phone) and who is responsible for logging them.
Data subject requests.
A workflow that holds up.
This solution builds a reliable circuit to receive, verify, search, decide and respond.
ResultActionable process
PriceFrom 700 € tax excl.
First stepScoping
SupportAvailable later
LimitNo absolute guarantee
A clear workflow, from request to evidence.
Access, rectification, erasure, objection, portability: every request from an individual must be received, verified, handled and documented on time. Without a procedure, requests get lost between customer service, HR and IT. This solution sets up a simple workflow your teams can actually follow.
What the solution covers
Verification
Proportionate identity checks, requested only when there is reasonable doubt, without collecting more data than needed.
Search and decision
The tools and databases to search, the cases where a request can be refused or limited, and sign-off on the reply.
Reply and evidence
Reply templates, secure sending and a log that proves each request was handled.
How the engagement works
- 01
Map
Intake channels, systems holding data and people involved.
- 02
Write
Procedure, roles, reply templates and request log.
- 03
Train
A short session with front-line teams: customer service, HR, IT.
- 04
Test
An end-to-end mock request to check timing and evidence.
Deliverables
- Data subject request procedure
- Roles and systems matrix
- Acknowledgement and reply templates
- Request log
- Mock request report
Who it is for
- Companies receiving requests from customers, candidates or employees
- Suppliers whose European clients require a procedure
- Organisations that have already missed a deadline
Frequently asked questions
How long do we have to answer a request? +
The GDPR requires a reply within one month of receipt. This can be extended by two further months for complex or numerous requests, provided the person is informed within the first month.
Can we ask for an ID document? +
Only when there is reasonable doubt about the requester’s identity, and proportionately. Systematically asking for a copy of an ID may be excessive.
What about a manifestly unfounded request? +
The GDPR allows you to refuse a manifestly unfounded or excessive request, or to charge a reasonable fee. The refusal must be reasoned and documented, and the person told how to complain.
Does the solution include software? +
No. The workflow is built on your existing tools first. If a dedicated tool would help, we recommend options; technical implementation is quoted separately.
The solution covers the scope defined in the proposal. Technical implementation and external legal fees are separate where needed.