Access requests and data subject rights (DSAR)
Manage access, rectification, deletion, and portability requests within legal deadlines.
What rights does Law 25 grant?
Law 25 gives individuals several rights over their personal information: the right of access (view data held), the right of rectification (correct inaccurate information), the right to de-indexation (removal from search engines), the right to portability (receive data in a structured format), and the right to withdraw consent. Your organization must respond to these requests within 30 days.
Intake channels
Conformaze provides two default channels for receiving requests: the Conformaze Portal (an online form integrated into your privacy policy) and the Conformaze API (for technical integrations). You can also manually record requests received by email, phone, or mail. Each channel is documented in the request register.
Processing a request
When a request arrives, Conformaze automatically creates a case with a tracking number. You verify the requester's identity, qualify the type of request (access, rectification, deletion, portability), and assign a responsible person. The 30-day deadline is automatically calculated with alerts at 7 days, 3 days, and on the due date. Each processing step is tracked.
Responding and closing
Once the request is processed, you send the response to the requester and close the case. Conformaze keeps the complete history: date of receipt, acknowledgment, date of response, content of the response, and closing date. If you need to refuse a request (legitimate reason provided by law), the justification is documented in the case.