Data subject requests are where data protection failures most often become visible, usually not because nobody wants to answer, but because the request sits in one person’s inbox while the deadline runs. The module turns every request into a case with a calculated deadline, an owner and evidence.

At a glance

Included from: Professional
Where in the app: GDPR → Requests & incidents → Data subject requests
Output: Case with deadline and history, response package as ZIP
Legal basis: Art. 12, 15–22 GDPR; Sec. 29, 34, 35 BDSG
API: /api/v1/data-subject-requests

Request types

Value	Right
ACCESS	Access (Art. 15)
RECTIFICATION	Rectification (Art. 16)
ERASURE	Erasure (Art. 17)
RESTRICTION	Restriction of processing (Art. 18)
PORTABILITY	Data portability (Art. 20)
OBJECTION	Objection (Art. 21)
AUTOMATED_DECISION	Rights regarding automated decisions: human intervention, expressing one’s point of view, contesting the decision (Art. 22(3))

The deadline: one calendar month from receipt

Art. 12(3) GDPR requires an answer "within one month of receipt". SimpleAct therefore counts in calendar months, not a flat 30 days: the deadline ends on the day of the following month with the same number; if that day does not exist, on the last day of that month (Art. 3(2)(c) Regulation No 1182/71). Example: received 31 January, deadline 28 or 29 February. The calendar used is Europe/Berlin.

The date of receipt is decisive. For requests by e-mail, letter or phone you enter it yourself when creating the case; if left empty, the time of entry applies. The list is sorted by deadline and overdue cases are highlighted. The status "needs info" does not pause the deadline.

Extending the deadline by two months

Art. 12(3) sentences 2 and 3 GDPR allows an extension by two further months where necessary given the complexity and number of requests. The app keeps it in dedicated fields:

Reason for the extension: required, because you have to tell the data subject.
Date of the decision or notice: only possible within the first period.
Extended deadline: original deadline plus two calendar months, calculated by the same rule. From then on this deadline counts.
Possible only once. Clearing the reason withdraws the extension.

Public form and identity check

Public form

Your organisation gets a public request form at its own address. Incoming requests are recorded with source PUBLIC, and the deadline runs from receipt.

Confirmation link

A request submitted through the form is never verified immediately. If the person gives an e-mail address, they receive a confirmation link valid for seven days. Without an e-mail you verify the identity by other means and mark it in the case.

Requests entered internally

Requests you create yourself get the source INTERNAL. Here too, "identity verified" starts as "no" and has to be confirmed deliberately. Where there are reasonable doubts about the identity, you may request additional information (Art. 12(6) GDPR).

Summary

Public requests that are not yet confirmed are counted separately in the summary.

Status

Status	Meaning
NEW	Received, not yet handled.
IN_PROGRESS	Being handled.
NEEDS_INFO	Awaiting information from the data subject; the deadline keeps running.
FULFILLED	Answered.
REJECTED	Refused or restricted, only with reasons (Art. 12(4)).
WITHDRAWN	Withdrawn by the person.

What a case also records

Basis of a restriction or refusal: Sec. 29, 34 or 35 BDSG, Art. 17(3) GDPR, manifestly unfounded or excessive (Art. 12(5)) or other, each with reasons.
Recipients notified under Art. 19 GDPR, with date.
Linked processing records, owner, response summary and evidence links.

The response package

For each request SimpleAct builds a ZIP with a README, an overview as HTML and PDF, the linked processing records (all of them if none are linked), every privacy notice as Markdown and PDF, and the processors. The package is built on download and not stored on the server; the language can be chosen.