# Rights requests: spotting them and responding within the deadline URL : https://skillrung.com/en/courses/data-compliance/responding-to-rights-requests Topic: Compliance & personal data · Duration: 20-30 min · Updated on 2026-09-15 ## In brief A rights request has no required form: written or spoken, it starts the deadline running from the moment it is received. The standard is one month, extendable by two months if the request is complex or if requests are numerous, provided the person is informed within the first month, with reasons. Verifying identity is mandatory, but proportionate. Holding nothing about the person does not authorise silence. ## Programme - 1. Spot the request before thinking about the answer : Recognise a rights request and know what to do with it the same day - 2. Data subject rights and how to respond to them : Identify a rights request and respond to it within the legal deadline - 3. Your action plan : Build the tracking of rights requests into your working week 1 content sections, each with its quiz. Three level quizzes: Beginner, Intermediate, Expert. ## Free preview (first 4 slides) ### 1. The request is already here, and so is the deadline Someone asks for what you hold about them. No registered letter, no legal vocabulary: a message, a form, sometimes a sentence said in passing at your structure. Nothing signals that something has just begun. The deadline, though, has been running since that minute. Spotting it and saying so the same day takes no legal expertise: that is the skill this course teaches. ### 2. What you will do without hesitating - Recognise a rights request, whatever channel it arrives by - Start the dated log as soon as it is received - Respond within the deadline after a proportionate verification ### 3. What you do as soon as it arrives Four steps, in order, from the moment the request arrives. - Write down the date it arrived and what the person is asking for - Pass the request on the same day, without sitting on it - Ask for a reasonable element that removes the doubt - Keep a dated log, from receipt to reply ### 4. Where do you stand? One question, with no score and no judgement, to see where your reflex stands: what would you do if the request arrived this morning? _Self-assessment of 1 questions in the player._ ## Access The first four slides of every course and the Beginner-level quiz are free, with no account. From the fifth slide onwards a subscription is required: €29.99/month incl. VAT, no commitment, cancellable online. skillrung is not a French training body certified under the Qualiopi scheme; its content is not eligible for the French CPF, OPCO or DPC schemes. ## Frequently asked questions ### How do you recognise a rights request when it is not called one? Do not look for legal wording. Someone who asks for their data, for a copy of their file, for the correction of inaccurate information or for the erasure of what you keep is exercising a right, whatever the channel used: reception, contact form, message, spoken word. No form is required. Note the date and the subject, then pass the request on the same day. ### Must you ask for an identity document before disclosing a file? The requester's identity must be verified: that is mandatory. But the verification must stay proportionate to the request. A reasonable element that removes the doubt is enough, provided you explain to the person why you are asking for it. Demanding a full identity document as a matter of course, when another element would do, is not the right answer. While you wait for that element, the deadline is suspended. ### We hold nothing about the person: do we still have to reply? Yes. Holding nothing about someone does not excuse you from replying: that is exactly the information they expect from you. Staying silent, on the other hand, reads as a refusal. The case looks harmless, but it is handled like any other: note the request, pass it on the same day, and tell the person where things stand. ## Sources - Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 (RGPD) : EUR-Lex, Union européenne, 2016-04-27, https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679 - Le registre des activités de traitement : CNIL, 2026-09-11, https://www.cnil.fr/fr/RGPD-le-registre-des-activites-de-traitement - Les bases légales d'un traitement de données personnelles : CNIL, 2026-09-11, https://www.cnil.fr/fr/les-bases-legales - Les durées de conservation des données : CNIL, 2026-09-11, https://www.cnil.fr/fr/passer-laction/les-durees-de-conservation-des-donnees - Professionnels : comment répondre à une demande de droit d'accès ? : CNIL, 2026-09-11, https://www.cnil.fr/fr/repondre-une-demande-de-droit-dacces - Travailler avec un sous-traitant : CNIL, 2026-09-11, https://www.cnil.fr/fr/sous-traitant - Notifier une violation de données personnelles : CNIL, 2026-09-11, https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles - Transférer des données hors de l'Union européenne : CNIL, 2026-09-11, https://www.cnil.fr/fr/les-outils-de-la-conformite/transferer-des-donnees-hors-de-lue