Request Types
SAR Portal supports all GDPR data subject rights. Understanding each type helps you process requests correctly.
Access Request (Article 15)
The right to access personal data
What the Subject Can Request
- Confirmation that you process their data
- A copy of their personal data
- Information about how their data is used
- Details of data sources and recipients
Your Obligations
- Respond within one month
- Provide data in commonly used electronic format
- First copy is free; may charge for additional copies
- Must not adversely affect rights of others
Processing Steps
- Verify subject’s identity
- Search all relevant data systems
- Compile personal data found
- Redact third-party information
- Prepare response package
- Send to subject securely
Erasure Request (Article 17)
The right to be forgotten
Valid Grounds for Erasure
- Data no longer necessary for original purpose
- Subject withdraws consent
- Subject objects and no overriding legitimate grounds
- Data processed unlawfully
- Legal obligation to erase
- Data collected from children for online services
Exemptions (When You May Refuse)
- Freedom of expression and information
- Legal obligations requiring retention
- Public health purposes
- Archiving in public interest
- Establishment or defense of legal claims
Processing Steps
- Verify the request is valid
- Check for exemptions
- Identify all data to be deleted
- Delete from all systems
- Notify any third parties
- Confirm deletion to subject
Rectification Request (Article 16)
The right to correct inaccurate data
What Can Be Corrected
- Factually incorrect information
- Outdated information
- Incomplete information (by adding data)
Processing Steps
- Identify the data in question
- Verify the correct information
- Update your records
- Notify third parties if shared
- Confirm changes to subject
Objection Request (Article 21)
The right to object to processing
Types of Objection
- General processing - Based on legitimate interests
- Direct marketing - Must always be honored
- Research/statistics - Unless necessary for public interest
Your Response
- For direct marketing: Stop immediately
- For other processing: Demonstrate compelling legitimate grounds
- May continue if grounds override subject’s interests
Restriction Request (Article 18)
The right to limit processing
When Restriction Applies
- Subject contests data accuracy (pending verification)
- Processing is unlawful but subject prefers restriction to erasure
- You no longer need data but subject needs it for legal claims
- Subject has objected (pending verification of legitimate grounds)
What Restriction Means
- Store the data but don’t process it
- May process with consent or for legal claims
- Mark data as restricted in your systems
Portability Request (Article 20)
The right to receive data in portable format
Requirements
- Data provided by the subject
- Processing based on consent or contract
- Processing carried out by automated means
Your Obligations
- Provide in structured, commonly used format (e.g., CSV, JSON)
- Machine-readable format
- Free of charge
- Transmit directly to another controller if requested
What to Provide
- Data actively provided by subject
- Data observed from subject’s activity
- NOT inferred or derived data
Automated Decision Objection (Article 22)
Rights related to automated decision-making
When This Applies
- Decisions made solely by automated processing
- That produce legal effects or significantly affect the subject
- Including profiling
Subject’s Rights
- Not be subject to such decisions
- Obtain human intervention
- Express their point of view
- Contest the decision
Exemptions
- Necessary for contract
- Authorized by law
- Based on explicit consent
Other Requests
Use this category for requests that don’t fit standard types:
- Combined requests (access + deletion)
- General privacy inquiries
- Complaints about data handling
- Requests for information about processing
Handling Multiple Request Types
If a subject makes multiple requests:
- Create one case per request type, OR
- Create one case and note all request types
- Address each right individually
- Ensure all are completed within deadline
If you create a case From Email and AI finds several request types in the email, SAR Portal can create one linked case per type for you. See Creating Cases.
Request Sequencing
When one email asks for several rights, the order in which you resolve them matters:
- A Rectification request should be handled before any related Access or Portability request, so the subject receives corrected data rather than data they would immediately ask you to fix.
- Any Access, Portability or Rectification request should be resolved before the Erasure request is closed, otherwise you risk deleting data the subject is still entitled to receive or correct.
SAR Portal checks this for linked cases, the cases created together from one email. It does not check other cases for the same subject.
- Closing an Erasure Request while a linked Access, Portability or Rectification case is still open shows a GDPR Sequencing Warning. The same warning appears when you close an Access or Portability case while a linked Rectification case is still open.
- The warning lists the open cases. You can still continue with Proceed — I acknowledge the risk, and the override is recorded in the audit log.
- If other linked cases are open but none of them must come first, a softer Linked Cases Still Open prompt asks you to confirm.
Request Type Quick Reference
| Type | Article | Must Respond In | Can Charge? |
|---|---|---|---|
| Access | 15 | one month | Free (first copy) |
| Erasure | 17 | one month | No |
| Rectification | 16 | one month | No |
| Objection | 21 | one month | No |
| Restriction | 18 | one month | No |
| Portability | 20 | one month | No |
| Automated | 22 | one month | No |
All deadlines can be extended by up to two further months (three months in total) for complex or numerous requests, with notification to the subject within the first month.