Handling Data Subject Requests

Best practices for handling data subject rights requests with the NDPR Toolkit

Introduction

The Nigeria Data Protection Regulation (NDPR) grants individuals (data subjects) specific rights regarding their personal data. Organizations must have processes in place to receive, verify, and respond to these requests within the timeframes specified by the regulation. This guide will help you implement a comprehensive system for handling data subject requests using the NDPR Toolkit.

NDPR Data Subject Rights

Under the NDPR, data subjects have the following rights:

  • Right of Access: To obtain confirmation of whether their data is being processed and access to that data
  • Right to Rectification: To have inaccurate personal data corrected
  • Right to Erasure: To have their personal data deleted in certain circumstances
  • Right to Restrict Processing: To limit how their data is used
  • Right to Data Portability: To receive their data in a structured, commonly used format
  • Right to Object: To object to certain types of processing, such as direct marketing

The Data Subject Request Process

A complete data subject request (DSR) system covers the entire lifecycle of a request, from submission to resolution. The NDPR Toolkit provides components for each stage of this process:

1

Request Submission

The first step is providing a way for data subjects to submit their requests. The NDPR Toolkit's DSRRequestForm component is designed for this purpose.

Code Example

import { DSRRequestForm } from '@tantainnovative/ndpr-toolkit';

function DSRSubmissionPage() {
  const requestTypes = [
    { id: 'access', label: 'Access my data' },
    { id: 'rectification', label: 'Correct my data' },
    { id: 'erasure', label: 'Delete my data' },
    { id: 'restriction', label: 'Restrict processing of my data' },
    { id: 'portability', label: 'Data portability' },
    { id: 'objection', label: 'Object to processing' }
  ];

  const handleSubmitRequest = (requestData) => {
    // Save request to your backend
    console.log('Request submitted:', requestData);
    
    // Example: Send to backend API
    fetch('/api/dsr-requests', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify(requestData),
    })
    .then(response => response.json())
    .then(data => {
      // Show confirmation to user with reference number
      setRequestId(data.id);
      setSubmitted(true);
    });
  };

  const [submitted, setSubmitted] = useState(false);
  const [requestId, setRequestId] = useState(null);

  return (
    <div>
      <h1>Submit a Data Subject Request</h1>
      
      {!submitted ? (
        <>
          <p>
            Use this form to exercise your rights under the Nigeria Data Protection Regulation (NDPR).
            We will respond to your request within 30 days.
          </p>
          
          <DSRRequestForm 
            onSubmit={handleSubmitRequest}
            requestTypes={requestTypes}
          />
        </>
      ) : (
        <div>
          <h2>Request Submitted</h2>
          <p>
            Your request has been submitted successfully. Your reference number is: <strong>{requestId}</strong>
          </p>
          <p>
            We will process your request and respond within 30 days. You can check the status of your request
            using your reference number.
          </p>
        </div>
      )}
    </div>
  );
}
2

Identity Verification

Before processing a request, you must verify the identity of the data subject to ensure they are who they claim to be. The NDPR Toolkit provides utilities for identity verification.

Implementation Tip

The level of identity verification should be proportionate to the sensitivity of the data and the potential harm that could result from unauthorized access. For example, requests for access to highly sensitive data may require more stringent verification than requests to update contact information.

3

Request Assessment

Once the identity of the data subject has been verified, you need to assess the request to determine what action is required. This includes identifying what data is involved, what systems it's stored in, and what actions need to be taken.

Code Example

import { DSRAssessment } from '@tantainnovative/ndpr-toolkit';

function AssessRequest({ request }) {
  const handleAssessment = (assessment) => {
    // Save assessment to your backend
    console.log('Assessment completed:', assessment);
    
    // Example: Update request with assessment
    fetch(`/api/dsr-requests/${request.id}/assessment`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify(assessment),
    });
  };

  return (
    <div>
      <h2>Assess Request</h2>
      <p>Request ID: {request.id}</p>
      <p>Request Type: {request.type}</p>
      
      <DSRAssessment
        request={request}
        onComplete={handleAssessment}
        dataSystems={[
          { id: 'crm', name: 'CRM System' },
          { id: 'marketing', name: 'Marketing Platform' },
          { id: 'analytics', name: 'Analytics Tools' },
          { id: 'email', name: 'Email System' },
          { id: 'billing', name: 'Billing System' }
        ]}
      />
    </div>
  );
}
4

Request Fulfillment

Based on the assessment, you need to fulfill the request by taking the appropriate action, such as providing a copy of the data, correcting inaccurate data, or deleting data. The NDPR Toolkit provides utilities for common fulfillment actions.

Implementation Tip

For complex requests that involve multiple systems or departments, consider using a workflow management system to track the progress of the request and ensure all necessary actions are taken.

5

Response to Data Subject

Once the request has been fulfilled, you need to respond to the data subject with the outcome of their request. The NDPR Toolkit provides templates for common response types.

Code Example

import { DSRResponse } from '@tantainnovative/ndpr-toolkit';

function GenerateResponse({ request, assessment, fulfillment }) {
  const handleGenerateResponse = (response) => {
    // Save response to your backend
    console.log('Response generated:', response);
    
    // Example: Send response to data subject
    fetch(`/api/dsr-requests/${request.id}/response`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify(response),
    });
  };

  return (
    <div>
      <h2>Generate Response</h2>
      <p>Request ID: {request.id}</p>
      <p>Request Type: {request.type}</p>
      
      <DSRResponse
        request={request}
        assessment={assessment}
        fulfillment={fulfillment}
        onGenerate={handleGenerateResponse}
        responseTypes={[
          'email',
          'letter',
          'portal'
        ]}
      />
    </div>
  );
}
6

Record Keeping

For compliance purposes, you must maintain records of all data subject requests and your responses to them. The NDPR Toolkit provides utilities for maintaining detailed request records.

Implementation Tip

Your record-keeping system should include the date of the request, the type of request, the actions taken, the date of the response, and any supporting documentation. This information may be needed to demonstrate compliance with the NDPR.

Administrative Dashboard

To efficiently manage data subject requests, you need an administrative dashboard that provides an overview of all requests and their status. The NDPR Toolkit's DSRDashboard component is designed for this purpose.

import { DSRDashboard } from '@tantainnovative/ndpr-toolkit';

function AdminDashboard() {
  const [requests, setRequests] = useState([]);
  
  useEffect(() => {
    // Fetch requests from your backend
    fetch('/api/dsr-requests')
      .then(response => response.json())
      .then(data => setRequests(data));
  }, []);
  
  const handleUpdateStatus = (requestId, status) => {
    // Update request status in your backend
    fetch(`/api/dsr-requests/${requestId}/status`, {
      method: 'PUT',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ status }),
    })
    .then(response => response.json())
    .then(data => {
      // Update local state
      setRequests(requests.map(request => 
        request.id === requestId ? { ...request, status } : request
      ));
    });
  };
  
  const handleAssignRequest = (requestId, assignee) => {
    // Assign request to staff member in your backend
    fetch(`/api/dsr-requests/${requestId}/assign`, {
      method: 'PUT',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ assignee }),
    })
    .then(response => response.json())
    .then(data => {
      // Update local state
      setRequests(requests.map(request => 
        request.id === requestId ? { ...request, assignedTo: assignee } : request
      ));
    });
  };
  
  const handleAddNote = (requestId, note) => {
    // Add note to request in your backend
    fetch(`/api/dsr-requests/${requestId}/notes`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ note }),
    })
    .then(response => response.json())
    .then(data => {
      // Update local state
      setRequests(requests.map(request => 
        request.id === requestId ? { 
          ...request, 
          notes: [...request.notes, data] 
        } : request
      ));
    });
  };

  return (
    <div>
      <h1>DSR Admin Dashboard</h1>
      
      <DSRDashboard 
        requests={requests}
        onUpdateStatus={handleUpdateStatus}
        onAssignRequest={handleAssignRequest}
        onAddNote={handleAddNote}
        staff={[
          { id: 'john', name: 'John Doe' },
          { id: 'jane', name: 'Jane Smith' },
          { id: 'bob', name: 'Bob Johnson' }
        ]}
        statuses={[
          { id: 'pending', label: 'Pending', color: 'yellow' },
          { id: 'verifying', label: 'Verifying Identity', color: 'blue' },
          { id: 'processing', label: 'Processing', color: 'purple' },
          { id: 'completed', label: 'Completed', color: 'green' },
          { id: 'rejected', label: 'Rejected', color: 'red' }
        ]}
      />
    </div>
  );
}

Request Tracking for Data Subjects

Data subjects should be able to track the status of their requests. The NDPR Toolkit's DSRTracker component provides a user interface for this purpose.

import { DSRTracker } from '@tantainnovative/ndpr-toolkit';

function RequestTrackingPage() {
  const [requestId, setRequestId] = useState('');
  const [email, setEmail] = useState('');
  const [request, setRequest] = useState(null);
  const [error, setError] = useState(null);
  
  const handleTrackRequest = () => {
    // Fetch request status from your backend
    fetch(`/api/dsr-requests/track?id=${requestId}&email=${email}`)
      .then(response => {
        if (!response.ok) {
          throw new Error('Request not found or email does not match');
        }
        return response.json();
      })
      .then(data => {
        setRequest(data);
        setError(null);
      })
      .catch(err => {
        setRequest(null);
        setError(err.message);
      });
  };

  return (
    <div>
      <h1>Track Your Request</h1>
      <p>
        Enter your request reference number and the email address you used to submit the request.
      </p>
      
      <div className="form-group">
        <label htmlFor="requestId">Request Reference Number</label>
        <input
          type="text"
          id="requestId"
          value={requestId}
          onChange={(e) => setRequestId(e.target.value)}
        />
      </div>
      
      <div className="form-group">
        <label htmlFor="email">Email Address</label>
        <input
          type="email"
          id="email"
          value={email}
          onChange={(e) => setEmail(e.target.value)}
        />
      </div>
      
      <button onClick={handleTrackRequest}>Track Request</button>
      
      {error && (
        <div className="error">
          {error}
        </div>
      )}
      
      {request && (
        <DSRTracker 
          request={request}
          statusDescriptions={{
            'pending': 'Your request has been received and is awaiting review.',
            'verifying': 'We are verifying your identity to process your request.',
            'processing': 'Your request is being processed.',
            'completed': 'Your request has been completed.',
            'rejected': 'Your request has been rejected. Please see the notes for more information.'
          }}
        />
      )}
    </div>
  );
}

Best Practices

Clear Request Process

Make it easy for data subjects to submit requests by providing a clear, accessible process. Include information about what to expect and how long the process will take.

Robust Identity Verification

Implement appropriate identity verification measures to ensure you're providing data to the right person. This is crucial for preventing unauthorized access to personal data.

Timely Responses

The NDPR requires organizations to respond to data subject requests within 30 days. Implement processes and systems that enable you to meet this deadline.

Comprehensive Data Mapping

Maintain a comprehensive map of where personal data is stored in your organization. This will help you quickly locate and retrieve data when responding to access requests.

Staff Training

Ensure that staff who handle data subject requests are trained on the NDPR requirements and your organization's processes. This includes understanding the different types of requests and how to respond to them.

Detailed Record Keeping

Maintain detailed records of all data subject requests and your responses to them. This is essential for demonstrating compliance with the NDPR.

Handling Specific Types of Requests

Access Requests

When handling access requests, you should:

  • Verify the identity of the data subject
  • Locate all personal data you hold about the data subject
  • Provide a copy of the data in a commonly used electronic format
  • Include information about the purposes of processing, categories of data, recipients, retention periods, and data subject rights

Rectification Requests

When handling rectification requests, you should:

  • Verify the identity of the data subject
  • Verify the accuracy of the new data provided
  • Update the data in all systems where it's stored
  • Inform any third parties with whom you've shared the data about the correction

Erasure Requests

When handling erasure requests, you should:

  • Verify the identity of the data subject
  • Determine if one of the grounds for erasure applies
  • Delete the data from all systems where it's stored
  • Inform any third parties with whom you've shared the data about the erasure
  • Implement technical measures to ensure the data is permanently deleted

Restriction Requests

When handling restriction requests, you should:

  • Verify the identity of the data subject
  • Determine if one of the grounds for restriction applies
  • Implement technical measures to restrict processing of the data
  • Inform any third parties with whom you've shared the data about the restriction
  • Inform the data subject before lifting the restriction

Portability Requests

When handling portability requests, you should:

  • Verify the identity of the data subject
  • Extract the data in a structured, commonly used, machine-readable format
  • Provide the data directly to the data subject or to another controller if requested and technically feasible
  • Ensure the data includes only personal data provided by the data subject

Objection Requests

When handling objection requests, you should:

  • Verify the identity of the data subject
  • Stop processing the data unless you can demonstrate compelling legitimate grounds that override the interests of the data subject
  • Inform the data subject of your decision and their right to complain to the supervisory authority

Additional Resources

NDPR Implementation Framework

Official guidance on implementing the NDPR, including data subject rights requirements.

View Framework

DSR Component Documentation

Technical documentation for the Data Subject Rights components.

View Documentation