Use Case: Data Subject Access Request (DSAR)

Posted 2 months ago by Harrison Gowers

TABLE OF CONTENTS

Overview
Step 1: Log the Request and Open a New Ticket
Step 2: Send the "Request received" email
Step 3: Confirm the details of the request
Step 4: Verify the subject's identity
Step 5: Process the data
Step 6: Disclose the data
Step 7: Archive the ticket

Overview

This guide demonstrates how to use the Workflows app to process and manage a Data Subject Access Request (DSAR) in Smartbox.ai. It can serve as a basis for customising the default templates or creating new ones from scratch.

Note: The steps in the default DSAR template are for guidance purposes only. Duplicate the template and customise it to fit your organisation’s processes.

Step 1: Log the Request and Open a New Ticket

Click "New ticket" from the Workflows Dashboard
Enter the request details:
- Choose a one calendar month timeframe.
- Select the "Default: Data Subject Access Request" workflow template.
- Click "Open" to create the ticket.
A new box will be automatically generated in Smartbox home with the name of the ticket. This is where all data for the request must be processed.

Step 2: Send the "Request received" email

Open the ticket.
This step sends an email notifying the data subject of receipt their request.
Review the content of the email, make any changes and hit "Send".
The "Next" button will unlock. Click it to advance to the next stage.

Step 3: Confirm the details of the request

This step enables you to ask the data subject to confirm their personal details and provide any additional information about their request. This is achieved by sending a web form to the subject via email, thereby capturing the information in a secure manner.

Review the content of the email, make any changes and hit "Send". The "Tracking" panel will provide updates on whether the subject has clicked on the link and submitted the requested information.
When the subject has completed the form, return to the ticket and their response will be displayed.
Review the information and:
- If valid, click "Complete" to proceed to the next stage.
- If invalid, repeat the previous step by clicking "Back" and re-sending the Request details email with any necessary clarification or extra information.

Step 4: Verify the subject's identity

This step allows you to confirm the data subject's identity by requesting they provide a copy of a form of ID. This is done by sending a web form that supports file uploads to the subject, capturing the information in a secure manner.

Review the content of the email, make any changes and hit "Send".
- The "Tracking" panel will provide updates on whether the subject has clicked on the link and submitted the requested information.
When the subject has completed the form, return to the ticket and their submission will be displayed. Review a file upload by clicking on the thumbnail to open it full size.
- If valid, click "Complete" to proceed to the next stage.
- If invalid, repeat the previous step by clicking "Back" and re-sending the ID verification email with further clarification or a request for an alternative form of ID.

Step 5: Process the data

Using the box linked to the ticket, process the relevant data collected for the request as normal:
- Upload
- (Cull)
- (Redact)
- Review
Note: This step can be carried out at any point after opening the ticket.
Once the data has been processed, return to the ticket.

Step 6: Disclose the data

This step enables the sending of data to the subject securely. An email is sent containing a link to a web page from which a zip folder containing the disclosure can be downloaded.

First choose the files you want to import into the ticket. This is done by configuring the options in the "Include" panel.
Click "Import" and the results of your configuration will be displayed in the "Pack it up" panel. The import step can be tweaked and repeated if necessary.
Once the desired files have been imported, click "Pack" to prepare them for sending. This may take a few moments, after which you will be taken to the "Send" page.
Review the content of the email, make any changes and hit "Send".
- The "Tracking" panel will provide updates on whether the subject has visited the page and downloaded the data.
Once the data has been downloaded the "Delivered" page becomes available. This page provides a summary of the process you have followed and all details of the request.

Step 7: Archive the ticket

After disclosing the data, the ticket will be labelled as "Completed" in the Dashboard.
Click on the status drop-down and select "Archive". This will send it to the Archive page.
- Note: archiving is a permanent action and cannot be undone.
If erasing the data from the request is necessary after its completion this is carried out from the Archive. Click the options button on the ticket and choose "Delete box". This will permanently delete the box and all the data within.

<<< Tickets Quickstart