Case Statuses
Cases move through different statuses as they’re processed. Understanding these statuses helps you manage your workflow efficiently.
Working Statuses
These statuses indicate active cases that require attention:
Opened
Initial status when a case is created.
- Case has been received but not yet worked on
- One-month deadline timer is running
- Appears in “requires attention” counts
In Progress
Case is actively being worked on.
- Documents are being gathered
- Data is being compiled
- Response is being prepared
Identity Verified
Subject’s identity has been confirmed.
- Identity verification completed
- Safe to proceed with providing personal data
- Important step before disclosing sensitive information
Awaiting Information
Waiting for the data subject to provide additional information.
- Clock may be paused (depending on jurisdiction)
- Subject has been contacted
- Case cannot proceed until response received
Information Received
Subject has responded with requested information.
- New information received
- Ready to continue processing
- Review the submitted information
Deadline Extended
Deadline has been extended per GDPR Article 12.
- Complex request requiring more time
- Subject has been notified of extension
- New deadline calculated (up to 2 additional months)
Closed Statuses
These statuses represent completed cases:
Completed & Fulfilled
Request was fully satisfied.
- All requested data provided
- Or all requested deletions completed
- Subject has received response
Rejected
Request was lawfully denied.
- Valid grounds for rejection exist
- Subject notified of reasons
- Legal basis documented
Rejection grounds include:
- Manifestly unfounded request
- Excessive/repetitive requests
- Request affects rights of others
- Legal exemptions apply
Withdrawn by Subject
Subject withdrew their request.
- Subject cancelled the request
- Written confirmation received
- No further action required
No Data Found
No personal data found for the subject.
- Search completed
- No matching records exist
- Subject informed of outcome
Duplicate Request
Request is a duplicate of another case.
- Same subject, same request type
- Previous case already handles this
- Note the original case in the Closure Notes
Invalid Request
Request does not meet requirements.
- Not a valid GDPR request
- Subject not identifiable
- Request outside scope
Status Workflow
A typical case moves like this:
Opened
↓ Start Processing
In Progress
↓ Request Info (if you need ID or clarification)
Awaiting Information → Information Received
↓ Mark Verified
Identity Verified
↓ Extend Deadline (if needed)
Deadline Extended
↓ Close Case
[Closed Status]
The order is not fixed. The buttons in Quick Actions decide which moves are possible.
Changing Status
Open the case and use the Quick Actions buttons:
| Button | Shown when | Sets the status to |
|---|---|---|
| Start Processing | The case is Opened | In Progress |
| Mark Verified | Any working status except Identity Verified | Identity Verified |
| Request Info (reads Send Follow-up while Awaiting Information) | Any working status | Awaiting Information |
| More Actions > Extend Deadline | Any working status | Deadline Extended |
| Close Case | Any working status | The closed status you choose |
Information Received is set when the requester replies through your portal, or when your team records their reply with Submit Info.
If an Admin has turned off a status in Settings > Case Management (Enabled Case Statuses), the Start Processing, Mark Verified or Extend Deadline button that sets it is hidden. Request Info and Close Case are not affected. Moving a UK case out of Awaiting Information also restarts a stopped statutory clock (see Deadlines & Extensions).
Document Collation Required
Your organisation can require document collation for every case. Then a Document Collation Required banner appears on a case that has no sources yet. Until you add at least one source in the Document Collation panel, Start Processing, Mark Verified, Request Info and Close Case are disabled. A case with a source marked Blocked cannot be closed until you resolve it, and the Close Case dialog warns you about sources not yet marked Disposed.
Status Best Practices
Verify Identity Before Disclosing Data
Always verify the subject’s identity before sharing personal data, especially for:
- Access requests containing sensitive data
- Requests received through non-verified channels
- High-value or sensitive records
Click Mark Verified to set the case to Identity Verified. A method and a timestamp are recorded automatically: Manual Review by Admin, unless Email One-Time Password was already recorded because the requester verified their email on your portal. See Identity Verification.
Use Awaiting Information Appropriately
Only use this status when you’ve actually contacted the subject and are waiting for their response. Document what information was requested.
Document Closure Reasons
When closing a case, always:
- Select the accurate closure status
- Add closing notes explaining the outcome
- Attach any final correspondence
30 days after a case closes, its documents and the requester’s contact details are removed automatically, unless the case is on legal hold. A one-way hash of the requester’s email and the audit trail are kept. You choose how long the case record itself is kept, counted from the date the case was created, before it is deleted: set the Global Case Retention Period in Settings > Case Management (default 12 months), and extend it for a single case if needed. Download anything you must keep before the 30 days are up. Closed cases can also be anonymized earlier by hand: see Case Actions.
Monitor Deadline-Extended Cases
Extended cases should be rare. If you’re extending frequently:
- Review your processes for efficiency
- Consider if you need more resources
- Check if requests could be handled faster
Audit Trail
Every status change is recorded in the case timeline and audit log, including:
- Who made the change
- When it occurred
- Previous and new status
- Any notes added
This creates a complete compliance record for regulatory review.