Data Subject Access Request (DSAR)

Verifying the identity of a Data Subject is an important step before processing requests involving personal information. TurtleShield supports OTP-based verification to help organizations confirm the identity of individuals submitting rights requests.

This verification process helps establish an additional layer of authentication before requests proceed through the fulfillment workflow.

Key capabilities include:

• OTP Authentication: Verify Data Subjects through one-time passwords.

• Identity Verification Workflow: Incorporate identity verification into the request submission and processing lifecycle.

• Supporting Document Collection: Accept relevant identity verification documents through request forms.

• Controlled Request Processing: Enable organizations to verify requester identity before proceeding with applicable request actions.

TurtleShield supports the management of different categories of Data Subject rights under the DPDPA through configurable request workflows.

Organizations can receive, categorize, track and process applicable requests through a centralized platform.

Key capabilities include:

• Right to Access: Manage requests seeking information about personal data and its processing, as applicable under the relevant regulatory framework.

• Right to Correction: Manage requests to correct inaccurate or incomplete personal data.

• Right to Erasure: Coordinate requests for erasure of personal data, subject to applicable legal requirements.

• Right to Nominate: Manage requests relating to the nomination of another individual to exercise rights in specified circumstances.

• Right to Grievance Redressal: Receive and manage grievances raised by Data Subjects through structured workflows.

• Configurable Request Categories: Organize incoming requests according to the applicable right and processing requirements.

Different categories of Data Subject requests may require different processing activities and response timelines. TurtleShield enables organizations to configure due dates based on request type, supporting alignment with applicable regulatory requirements and internal service policies.

Key capabilities include:

• Request-Specific SLAs: Configure response timelines according to individual request categories.

• Due Date Configuration: Establish due dates for requests based on organizational policies and applicable regulatory obligations.

• Remaining SLA Visibility: Monitor the time remaining for requests through centralized dashboards.

• Overdue Request Tracking: Identify requests that have crossed their configured due dates and require attention.

• Timeline Monitoring: Maintain visibility into request progress against established processing timelines.

TurtleShield manages each Data Subject request through a defined lifecycle based on its request category. Configurable workflow stages help organizations coordinate activities, maintain ownership and track requests from initial submission to closure.

Key capabilities include:

• Request-Specific Workflows: Configure processing stages according to the type of rights request.

• Structured Request Progression: Move requests through defined stages from intake and verification to processing and closure.

• Centralized Status Tracking: Monitor the current status of individual requests.

• Workflow Traceability: Maintain visibility into request progression and associated processing activities.

• Consistent Request Handling: Apply structured workflows across different request categories and teams.

Identifying relevant personal data across distributed enterprise systems can be one of the most time-consuming activities in rights-request fulfillment.

TurtleShield Data Subject Rights Management can integrate with TurtleShield Data Discovery to initiate a discovery scan when a new request is received. This helps organizations identify relevant personal data across connected repositories and reduces the need for manual data searches.

Key capabilities include:

• Automated Scan Initiation: Trigger Data Discovery scans for new rights requests through the configured integration.

• Personal Data Identification: Identify relevant personal information across connected data sources.

• Structured and Unstructured Data Discovery: Leverage supported discovery capabilities to locate information across enterprise repositories.

• Reduced Manual Effort: Streamline the identification of personal data required for request processing.

• Connected Request Fulfillment: Bring data discovery activities into the broader rights-request management process.

Transparent communication is important throughout the rights-request lifecycle. TurtleShield provides communication capabilities that allow organizations to share updates, seek clarifications and inform Data Subjects about delays during request processing.

Key capabilities include:

• Request Status Communication: Share relevant updates about the progress of submitted requests.

• Clarification Requests: Communicate with Data Subjects when additional information is required.

• Delay Notifications: Inform individuals about processing delays through configured communication workflows.

• Centralized Communication: Coordinate request-related communication as part of the broader rights-management process.

• Improved Transparency: Keep Data Subjects informed throughout the request lifecycle.

TurtleShield provides a centralized dashboard that helps privacy and compliance teams monitor rights-request activities and assess operational performance.

The dashboard provides visibility into request volumes, processing status, overdue requests and remaining SLA time, enabling teams to identify pending activities and prioritize requests requiring attention.

Key capabilities include:

• Request Volume Monitoring: View the volume of incoming and processed rights requests.

• Request Status Visibility: Monitor requests according to their current processing stages.

• SLA Monitoring: Review remaining response time for individual requests.

• Overdue Request Tracking: Identify requests that have exceeded their configured due dates.

• Centralized Operational View: Monitor rights-request performance through a unified dashboard.

• Request Documentation: Maintain request-related records and processing information to support internal reviews and accountability.