Chapter 18 — Privacy requests
Lesson map
Lesson 18 published. Map, example, EX052.
flowchart TD
N0["Learning outcomes"]
N1["18.1 Access requests"]
N2["18.2 Finding everything"]
N3["18.3 Corrections"]
N4["18.4 Erasure"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX052"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 Access requests"]
N2["18.2 Finding everything"]
N3["18.3 Corrections"]
N4["18.4 Erasure"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX052"]
[Learning outcomes]
|
v
[18.1 Access requests]
|
v
[18.2 Finding everything]
|
v
[18.3 Corrections]
|
v
[18.4 Erasure]
|
v
[Worked example] --> [Exercise EX052]
Learning outcomes
You will (1) support subject access requests technically; (2) find a person's data across systems; (3) handle correction and erasure requests.
18.1 Access requests
A tenant asks Calder Valley for a copy of all personal data held about them. The data protection officer coordinates, and Ravi helps find data. He uses the dictionary and inventory to list systems holding tenant data: housing system, contractor portal, complaints, call recordings index and shared drive files. He writes queries for each structured system using the tenant's identifiers. He notes that a good inventory turns a stressful search into a routine task. The officer welcomes the list of systems warmly.
18.2 Finding everything
The duplicate tenant records from earlier chapters matter here: the tenant has two records, and the second holds old repair history. Ravi finds it through the matching rules. He also searches the shared drive for the tenant's name, finding a spreadsheet of complaint notes. He compiles results for the officer, who reviews them, removes information about other people and sends the response within the legal deadline. Ravi records the search steps in a short guide, so that the next request can be handled faster and more consistently by any member of the data team.
18.3 Corrections
Another tenant reports that their phone number is wrong. The correction must be made in the housing system and also in the contractor portal, which holds a copy for appointment calls. Ravi documents which systems hold copies of each tenant field, so corrections reach all of them. He notes that copies are where corrections often fail, leaving outdated data in some systems while the main record is correct. Corrections now include a check of each copy listed, and the officer confirms that the tenant's number has been updated everywhere.
18.4 Erasure
A former tenant asks for erasure. The officer decides which data can be erased and which must be kept, such as rent records needed for financial obligations. Ravi carries out deletion in the systems where data can be erased and records what was removed and what was retained, with reasons. Ms. Moreau notes that technologists need clear instructions from the officer, because erasure decisions involve legal judgement that technical staff should not make alone. Ravi's record is filed with the original request.
Worked example
Ravi lists systems holding tenant data for an access request, finds a duplicate record and a complaint spreadsheet, maps copies of fields for corrections and carries out erasure under the officer's instructions.
Synthetic case. Requests are synthetic; the GDPR is real. This is not legal advice.
Errors and limits
Corrections made only in the main system leave outdated copies elsewhere.
Exercises
- EX052 — Hidden data. What hidden data did Ravi find for the access request? Rubric: 3 = a duplicate record and a complaint spreadsheet;; 2 = both;; 1 = one;; 0 = none.
- EX053 — Phone copy. Where was a copy of the phone number? Rubric: 3 = the contractor portal;; 2 = partly correct;; 1 = other;; 0 = none.
- EX054 — Retained records. Which records were kept despite erasure? Rubric: 3 = rent records for financial obligations;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 18 (chapter 18 of 30)
← Chapter 17 · Course chapter index · Chapter 19 →
Continue to the next authored lesson.