GDPR data subject requests, answered on time
Access, erasure, rectification and portability requests arrive through one page. The one-month clock starts the day each request is received, and every step is recorded so you can show how it was handled.
What the GDPR requires
Under Articles 15 to 21 of the GDPR, anyone whose personal data you hold can ask to see it, correct it, erase it, restrict how it is used, receive it in a portable format, or object to its processing. Every organisation that processes personal data about people in the EU must handle these requests, whatever its size.
Article 12 sets the terms. You must respond without undue delay and within one month of receiving the request, free of charge in most cases. If a request is complex, or you receive a large number of them, you can extend by up to two further months, but you have to tell the person within the first month and explain why.
Requests rarely arrive neatly. They come through a web form, an email to a manager, a letter or a phone call, and often at the least convenient moment, such as during an employment dispute. The deadline starts when any of them reaches your organisation, whoever happens to open it.
The deadlines
The GDPR's clock runs from receipt, not from when someone gets round to reading the request.
- 1 monthRespond to the request
Counted from the day the request is received, on every channel: form, email, letter or phone.
- up to 2 monthsExtend a complex request
Further time where the request's complexity or the number of requests makes it necessary. You must tell the person within the first month, with your reasons.
How it works
- A request arrives
Through your own request page, where the person chooses the right they are exercising and describes what they want, or logged by your team when it came by letter, email, phone or in person.
- Identity is confirmed
The requester confirms their email address automatically. Requests you log by hand go to manual verification, so you ask only for what you actually need.
- Your team works the case
Assign a handler, keep internal notes, start from a response template for the right in question and attach files. Every action lands on the request's timeline.
- The requester is kept informed
They are emailed when you respond, extend or close the request, and can check its progress on a status page without creating an account.
- The evidence is ready
Each request produces a PDF case file, and the register shows the year at a glance: requests by right and outcome, extensions, refusals and how many closed within the deadline.
What's included
Your own request page
A public page for your organisation in Polish, English or Romanian, with your data protection officer's contact details and an introduction you write.
Offline intake
Log requests that arrived by letter, email, phone or in person, so every request sits in the same queue and runs on the same clock.
A queue that shows what is due
Every open request with its days remaining, unverified requests kept apart, and escalation to a named colleague when one needs attention.
Response templates
Model wording for each right in Polish, English and Romanian, with a recorded reason whenever you refuse a request.
Files both ways
Requesters and handlers can both attach documents. Location and author metadata is stripped from images, PDFs and Office documents before they are stored.
Register and exports
A yearly summary of requests by right and outcome, a CSV export, and a PDF case file for each request.
Retention you control
Closed requests are erased after the period you choose. The register entry stays, so the record of how you handled each request survives.
Built for advisors
Data protection officers and advisors who look after several organisations get one queue across every client organisation that uses Klaruna for data subject requests.
Data and security
Everything runs in EU data centres: the application, the database, file storage, backups and email delivery.
Request content is encrypted at rest, and every action, from intake and verification to response, extension and closure, is written to an append-only audit trail.
Where it applies
Applies across the EU.