Consent Docs
Open console

Ways people send a rights request

The three ways a rights request reaches you, and what each one means for the Requests queue and for checking who is asking.

Concept4 min readFor privacy, marketing and support teams

A rights request is something a person asks you to do about their data: see it, correct it, erase it, stop using it, or answer a complaint. It can reach you in three ways. The way decides whether it appears on the Requests page, and who checks that the person is who they say.

The three ways#

Way Who starts it On the Requests page Who checks identity
The hosted request page The person Yes The person, through a link sent by email
Your own page, through the API The person, on your site or app No Your site, for example by sign-in
Logged by staff Your team, after an email, call or letter Yes Your team

The hosted request page#

Every publishable key has a request page of its own. Link to it from your privacy policy and your footer.

https://console.dpconsent.com/consent/sdk/v1/pages/<publishable key>/request

The page asks What would you like to do?, then for an identifier, a reply address and details. The person chooses Send request and sees a reference such as DSR-2026-4F2A91. The page appears in the visitor's language when one is available.

The page also asks Who is making this request? A parent, a lawful guardian or a nominee can ask for someone else. They add their own name and email address or phone number. Your team then confirms their authority, as in Handle a request made for someone else.

Two links lead to the page with no work from you. The banner carries a Your rights link when a form is shown under India's DPDP Act. The hosted privacy notice carries a Make a request link.

Anyone who knows the address can send a request, so each one starts as Verifying identity. The product sends your server the subject_request.received webhook, which carries a confirmation link. Your server emails that link to the person. When they open it and choose Confirm request, the request moves to In progress. The page then links to the request's status page, where the person later reads your reply.

The product does not send the email

PIEDAP Consent sends no email itself. If no endpoint receives subject_request.received, the person never gets the link, and the request cannot be completed. Ask an administrator to add a webhook endpoint for it.

Your own page, through the API#

Your developers can let people act from your own site or app, for example from an account page. Your server calls the API to list what is held for the person, export it, withdraw their consent or erase them. The action happens at once.

What that means for your team:

  • No request appears on the Requests page, and no deadline is tracked.
  • Your site checks who the person is, for example by sign-in.
  • Each call is written to the audit log.
  • A withdrawal or an erasure shows on the person's records. It sends the same consent.withdrawn and subject.erased webhooks as the console.

The ready-made version is the hosted Your consents page. Your server issues a link to it for one person, and the link works for seven days. The page shows the person's live records, with Withdraw this consent on each and Download your records (JSON). A withdrawal made there creates no request. It is recorded on the consent record at once and sends consent.withdrawn.

Logged by staff#

A person may write to you, phone you or send a letter. A member of your team then adds the request with Log a request. It joins the same queue as the hosted requests, with a reference and a deadline.

No confirmation link is sent for a logged request, so your team checks who the person is. The deadline runs from the moment the request is logged.

An example#

Kavya Nair phones the support line of an online shop and asks for her data to be deleted. The agent checks who she is, then logs an erasure request with her email address. The request appears on Requests with its deadline and the consent records found for her.

Arjun Mehta follows the Your rights link in the shop's banner instead. His request waits as Verifying identity until he opens the link the shop emails him. Both requests then sit in one queue, and the team answers each before its deadline.

Limits#

  • The product sends nothing to the person. Your systems send the confirmation link and email your reply. The person can also read the reply on the status page.
  • One network address can send five requests an hour through the hosted page.
  • The hosted page asks for Your email address or account id. To ask for something else, such as a customer number, set The rights request form asks for in project settings.
  • An action taken through the API never appears on the Requests page.

↑↓ to move, Enter to open