Chapter 6 — Privacy and data protection: operational workflow

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Access requests at Halden"]
  N2["6.2 Deadline lab"]
  N3["6.3 Improving the workflow"]
  N4["6.4 Results"]
  N5["Lab — Access request deadlines"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Access requests at Halden"]
  N2["6.2 Deadline lab"]
  N3["6.3 Improving the workflow"]
  N4["6.4 Results"]
  N5["Lab — Access request deadlines"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 Access requests at Halden]
    |
    v
[6.2 Deadline lab]
    |
    v
[6.3 Improving the workflow]
    |
    v
[6.4 Results]
    |
    v
[Lab — Access request deadlines]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) run an access request workflow; (2) track deadlines with a lab; (3) improve the workflow.

6.1 Access requests at Halden

Candidates sometimes ask Halden for a copy of their data, often after being rejected for a role. Article 15 gives them the right to access their personal data, and Article 12(3) requires a response without undue delay and within one month, extendable by two further months for complex requests. Marta maps Halden's workflow: requests arrive by email to any consultant, are forwarded to the office manager and are answered by searching the recruitment system and mailboxes. Forwarding between people added several days to each request.

6.2 Deadline lab

Marta reviews a synthetic quarter of thirty-six access requests. The lab shows that 7 of 36, 19.4%, were answered after one month, and that the median time to answer was 21 days. Late requests usually involved searches of several consultants' mailboxes and waiting for reference checks. Nobody tracked deadlines centrally, so requests were noticed only when candidates chased them. Marta notes that the lab uses a simplified month calculation, which is enough to show the pattern but not to judge individual legal deadlines. The pattern was consistent across months.

6.3 Improving the workflow

Marta designs a central request log with the date received, identity check, systems searched, extension decision and date answered. Consultants forward requests to a single privacy mailbox the same day. A checklist lists every system and shared mailbox to search. She uses EDPB Guidelines 01/2022 to decide what the response must include, such as purposes, recipients, retention periods and the source of data obtained from job boards. Reminders are set for day twenty and day twenty-five. The identity check is proportionate: a reply from the email address on file is usually enough.

6.4 Results

Over the next synthetic quarter, the log records all requests, and none are answered late. The median time to answer falls because searches are planned from the first day. Marta adds two lessons to the procedure: extensions must be decided and communicated within the first month, not after it has passed, and reference documents may contain third-party information that requires careful review before release. Ms. Lin notes that operational workflows succeed when they make the right step the easy step for busy consultants.

Lab — Access request deadlines

"""Track access-request deadlines for a synthetic quarter (stdlib only)."""
import random, datetime
random.seed(4)
start = datetime.date(2026, 4, 1)
reqs = []
for i in range(36):
    recv = start + datetime.timedelta(days=random.randint(0, 80))
    took = random.choice([9, 12, 15, 18, 21, 24, 27, 33, 38, 45])
    reqs.append((recv, took))
def deadline(d):  # one month: same day next month (simplified, clamp to 28)
    m = d.month % 12 + 1; y = d.year + (d.month == 12)
    return datetime.date(y, m, min(d.day, 28))
late = [(r, t) for r, t in reqs if r + datetime.timedelta(days=t) > deadline(r)]
print(f"requests {len(reqs)}; answered after one month {len(late)} ({100*len(late)/len(reqs):.1f}%)")
print(f"median days to answer {sorted(t for _, t in reqs)[len(reqs)//2]}")

Run with python3 lab_deadlines.py. Verified output:

requests 36; answered after one month 7 (19.4%)
median days to answer 21

Worked example

Marta finds 7 of 36 synthetic requests (19.4%) answered after one month with a median of 21 days, creates a central log, checklist and reminders, and sees no late responses the next quarter.

Synthetic case. Requests are synthetic; GDPR Articles 12(3) and 15 and EDPB Guidelines 01/2022 are real.

Errors and limits

The lab simplifies month calculation; check legal deadlines individually.

Exercises

• EX026 — Late share. What share of requests was answered late?
  Show marking criteria

  Rubric: 3 = 7 of 36, 19.4%;; 2 = approximate;; 1 = wrong;; 0 = none.
• EX027 — Median. What was the median time to answer?
  Show marking criteria

  Rubric: 3 = 21 days;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX028 — Late cause. What usually caused lateness?
  Show marking criteria

  Rubric: 3 = searching several mailboxes and waiting for references;; 2 = mentions mailboxes;; 1 = vague;; 0 = none.
• EX029 — Response content. Name two things a response must include.
  Show marking criteria

  Rubric: 3 = purposes, recipients, retention, source;; 2 = two;; 1 = one;; 0 = none.
• EX030 — Extension timing. When must extensions be decided?
  Show marking criteria

  Rubric: 3 = within the first month;; 2 = partly correct;; 1 = later;; 0 = none.