Handling Data Subject Requests
Best practices for handling data subject rights requests with the NDPR Toolkit
Introduction
The Nigeria Data Protection Regulation (NDPR) grants individuals (data subjects) specific rights regarding their personal data. Organizations must have processes in place to receive, verify, and respond to these requests within the timeframes specified by the regulation. This guide will help you implement a comprehensive system for handling data subject requests using the NDPR Toolkit.
NDPR Data Subject Rights
Under the NDPR, data subjects have the following rights:
- Right of Access: To obtain confirmation of whether their data is being processed and access to that data
- Right to Rectification: To have inaccurate personal data corrected
- Right to Erasure: To have their personal data deleted in certain circumstances
- Right to Restrict Processing: To limit how their data is used
- Right to Data Portability: To receive their data in a structured, commonly used format
- Right to Object: To object to certain types of processing, such as direct marketing
The Data Subject Request Process
A complete data subject request (DSR) system covers the entire lifecycle of a request, from submission to resolution. The NDPR Toolkit provides components for each stage of this process:
Request Submission
The first step is providing a way for data subjects to submit their requests. The NDPR Toolkit's DSRRequestForm component is designed for this purpose.
Code Example
import { DSRRequestForm } from '@tantainnovative/ndpr-toolkit';
function DSRSubmissionPage() {
const requestTypes = [
{ id: 'access', label: 'Access my data' },
{ id: 'rectification', label: 'Correct my data' },
{ id: 'erasure', label: 'Delete my data' },
{ id: 'restriction', label: 'Restrict processing of my data' },
{ id: 'portability', label: 'Data portability' },
{ id: 'objection', label: 'Object to processing' }
];
const handleSubmitRequest = (requestData) => {
// Save request to your backend
console.log('Request submitted:', requestData);
// Example: Send to backend API
fetch('/api/dsr-requests', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify(requestData),
})
.then(response => response.json())
.then(data => {
// Show confirmation to user with reference number
setRequestId(data.id);
setSubmitted(true);
});
};
const [submitted, setSubmitted] = useState(false);
const [requestId, setRequestId] = useState(null);
return (
<div>
<h1>Submit a Data Subject Request</h1>
{!submitted ? (
<>
<p>
Use this form to exercise your rights under the Nigeria Data Protection Regulation (NDPR).
We will respond to your request within 30 days.
</p>
<DSRRequestForm
onSubmit={handleSubmitRequest}
requestTypes={requestTypes}
/>
</>
) : (
<div>
<h2>Request Submitted</h2>
<p>
Your request has been submitted successfully. Your reference number is: <strong>{requestId}</strong>
</p>
<p>
We will process your request and respond within 30 days. You can check the status of your request
using your reference number.
</p>
</div>
)}
</div>
);
}
Identity Verification
Before processing a request, you must verify the identity of the data subject to ensure they are who they claim to be. The NDPR Toolkit provides utilities for identity verification.
Implementation Tip
The level of identity verification should be proportionate to the sensitivity of the data and the potential harm that could result from unauthorized access. For example, requests for access to highly sensitive data may require more stringent verification than requests to update contact information.
Request Assessment
Once the identity of the data subject has been verified, you need to assess the request to determine what action is required. This includes identifying what data is involved, what systems it's stored in, and what actions need to be taken.
Code Example
import { DSRAssessment } from '@tantainnovative/ndpr-toolkit';
function AssessRequest({ request }) {
const handleAssessment = (assessment) => {
// Save assessment to your backend
console.log('Assessment completed:', assessment);
// Example: Update request with assessment
fetch(`/api/dsr-requests/${request.id}/assessment`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify(assessment),
});
};
return (
<div>
<h2>Assess Request</h2>
<p>Request ID: {request.id}</p>
<p>Request Type: {request.type}</p>
<DSRAssessment
request={request}
onComplete={handleAssessment}
dataSystems={[
{ id: 'crm', name: 'CRM System' },
{ id: 'marketing', name: 'Marketing Platform' },
{ id: 'analytics', name: 'Analytics Tools' },
{ id: 'email', name: 'Email System' },
{ id: 'billing', name: 'Billing System' }
]}
/>
</div>
);
}
Request Fulfillment
Based on the assessment, you need to fulfill the request by taking the appropriate action, such as providing a copy of the data, correcting inaccurate data, or deleting data. The NDPR Toolkit provides utilities for common fulfillment actions.
Implementation Tip
For complex requests that involve multiple systems or departments, consider using a workflow management system to track the progress of the request and ensure all necessary actions are taken.
Response to Data Subject
Once the request has been fulfilled, you need to respond to the data subject with the outcome of their request. The NDPR Toolkit provides templates for common response types.
Code Example
import { DSRResponse } from '@tantainnovative/ndpr-toolkit';
function GenerateResponse({ request, assessment, fulfillment }) {
const handleGenerateResponse = (response) => {
// Save response to your backend
console.log('Response generated:', response);
// Example: Send response to data subject
fetch(`/api/dsr-requests/${request.id}/response`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify(response),
});
};
return (
<div>
<h2>Generate Response</h2>
<p>Request ID: {request.id}</p>
<p>Request Type: {request.type}</p>
<DSRResponse
request={request}
assessment={assessment}
fulfillment={fulfillment}
onGenerate={handleGenerateResponse}
responseTypes={[
'email',
'letter',
'portal'
]}
/>
</div>
);
}
Record Keeping
For compliance purposes, you must maintain records of all data subject requests and your responses to them. The NDPR Toolkit provides utilities for maintaining detailed request records.
Implementation Tip
Your record-keeping system should include the date of the request, the type of request, the actions taken, the date of the response, and any supporting documentation. This information may be needed to demonstrate compliance with the NDPR.
Administrative Dashboard
To efficiently manage data subject requests, you need an administrative dashboard that provides an overview of all requests and their status. The NDPR Toolkit's DSRDashboard component is designed for this purpose.
import { DSRDashboard } from '@tantainnovative/ndpr-toolkit';
function AdminDashboard() {
const [requests, setRequests] = useState([]);
useEffect(() => {
// Fetch requests from your backend
fetch('/api/dsr-requests')
.then(response => response.json())
.then(data => setRequests(data));
}, []);
const handleUpdateStatus = (requestId, status) => {
// Update request status in your backend
fetch(`/api/dsr-requests/${requestId}/status`, {
method: 'PUT',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({ status }),
})
.then(response => response.json())
.then(data => {
// Update local state
setRequests(requests.map(request =>
request.id === requestId ? { ...request, status } : request
));
});
};
const handleAssignRequest = (requestId, assignee) => {
// Assign request to staff member in your backend
fetch(`/api/dsr-requests/${requestId}/assign`, {
method: 'PUT',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({ assignee }),
})
.then(response => response.json())
.then(data => {
// Update local state
setRequests(requests.map(request =>
request.id === requestId ? { ...request, assignedTo: assignee } : request
));
});
};
const handleAddNote = (requestId, note) => {
// Add note to request in your backend
fetch(`/api/dsr-requests/${requestId}/notes`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({ note }),
})
.then(response => response.json())
.then(data => {
// Update local state
setRequests(requests.map(request =>
request.id === requestId ? {
...request,
notes: [...request.notes, data]
} : request
));
});
};
return (
<div>
<h1>DSR Admin Dashboard</h1>
<DSRDashboard
requests={requests}
onUpdateStatus={handleUpdateStatus}
onAssignRequest={handleAssignRequest}
onAddNote={handleAddNote}
staff={[
{ id: 'john', name: 'John Doe' },
{ id: 'jane', name: 'Jane Smith' },
{ id: 'bob', name: 'Bob Johnson' }
]}
statuses={[
{ id: 'pending', label: 'Pending', color: 'yellow' },
{ id: 'verifying', label: 'Verifying Identity', color: 'blue' },
{ id: 'processing', label: 'Processing', color: 'purple' },
{ id: 'completed', label: 'Completed', color: 'green' },
{ id: 'rejected', label: 'Rejected', color: 'red' }
]}
/>
</div>
);
}
Request Tracking for Data Subjects
Data subjects should be able to track the status of their requests. The NDPR Toolkit's DSRTracker component provides a user interface for this purpose.
import { DSRTracker } from '@tantainnovative/ndpr-toolkit';
function RequestTrackingPage() {
const [requestId, setRequestId] = useState('');
const [email, setEmail] = useState('');
const [request, setRequest] = useState(null);
const [error, setError] = useState(null);
const handleTrackRequest = () => {
// Fetch request status from your backend
fetch(`/api/dsr-requests/track?id=${requestId}&email=${email}`)
.then(response => {
if (!response.ok) {
throw new Error('Request not found or email does not match');
}
return response.json();
})
.then(data => {
setRequest(data);
setError(null);
})
.catch(err => {
setRequest(null);
setError(err.message);
});
};
return (
<div>
<h1>Track Your Request</h1>
<p>
Enter your request reference number and the email address you used to submit the request.
</p>
<div className="form-group">
<label htmlFor="requestId">Request Reference Number</label>
<input
type="text"
id="requestId"
value={requestId}
onChange={(e) => setRequestId(e.target.value)}
/>
</div>
<div className="form-group">
<label htmlFor="email">Email Address</label>
<input
type="email"
id="email"
value={email}
onChange={(e) => setEmail(e.target.value)}
/>
</div>
<button onClick={handleTrackRequest}>Track Request</button>
{error && (
<div className="error">
{error}
</div>
)}
{request && (
<DSRTracker
request={request}
statusDescriptions={{
'pending': 'Your request has been received and is awaiting review.',
'verifying': 'We are verifying your identity to process your request.',
'processing': 'Your request is being processed.',
'completed': 'Your request has been completed.',
'rejected': 'Your request has been rejected. Please see the notes for more information.'
}}
/>
)}
</div>
);
}
Best Practices
Clear Request Process
Make it easy for data subjects to submit requests by providing a clear, accessible process. Include information about what to expect and how long the process will take.
Robust Identity Verification
Implement appropriate identity verification measures to ensure you're providing data to the right person. This is crucial for preventing unauthorized access to personal data.
Timely Responses
The NDPR requires organizations to respond to data subject requests within 30 days. Implement processes and systems that enable you to meet this deadline.
Comprehensive Data Mapping
Maintain a comprehensive map of where personal data is stored in your organization. This will help you quickly locate and retrieve data when responding to access requests.
Staff Training
Ensure that staff who handle data subject requests are trained on the NDPR requirements and your organization's processes. This includes understanding the different types of requests and how to respond to them.
Detailed Record Keeping
Maintain detailed records of all data subject requests and your responses to them. This is essential for demonstrating compliance with the NDPR.
Handling Specific Types of Requests
Access Requests
When handling access requests, you should:
- Verify the identity of the data subject
- Locate all personal data you hold about the data subject
- Provide a copy of the data in a commonly used electronic format
- Include information about the purposes of processing, categories of data, recipients, retention periods, and data subject rights
Rectification Requests
When handling rectification requests, you should:
- Verify the identity of the data subject
- Verify the accuracy of the new data provided
- Update the data in all systems where it's stored
- Inform any third parties with whom you've shared the data about the correction
Erasure Requests
When handling erasure requests, you should:
- Verify the identity of the data subject
- Determine if one of the grounds for erasure applies
- Delete the data from all systems where it's stored
- Inform any third parties with whom you've shared the data about the erasure
- Implement technical measures to ensure the data is permanently deleted
Restriction Requests
When handling restriction requests, you should:
- Verify the identity of the data subject
- Determine if one of the grounds for restriction applies
- Implement technical measures to restrict processing of the data
- Inform any third parties with whom you've shared the data about the restriction
- Inform the data subject before lifting the restriction
Portability Requests
When handling portability requests, you should:
- Verify the identity of the data subject
- Extract the data in a structured, commonly used, machine-readable format
- Provide the data directly to the data subject or to another controller if requested and technically feasible
- Ensure the data includes only personal data provided by the data subject
Objection Requests
When handling objection requests, you should:
- Verify the identity of the data subject
- Stop processing the data unless you can demonstrate compelling legitimate grounds that override the interests of the data subject
- Inform the data subject of your decision and their right to complain to the supervisory authority
Additional Resources
NDPR Implementation Framework
Official guidance on implementing the NDPR, including data subject rights requirements.
View FrameworkDSR Component Documentation
Technical documentation for the Data Subject Rights components.
View Documentation