compliance-request-intake: Скилл для автоматизации запросов

--- name: compliance-request-intake description: 'Sub-skill of compliance: Request Intake (+3).' version: 1.0.0 category: business type: reference scripts_exempt: true --- # Request Intake (+3) ## Request Intake When a data subject request is received: 1. **Identify the request type**: - Access (copy of personal data) - Rectification (correction of inaccurate data) - Erasure / deletion ("right to be forgotten") - Restriction of processing - Data portability (structured, machine-readable format) - Objection to processing - Opt-out of sale/sharing (CCPA/CPRA) - Limit use of sensitive personal information (CPRA) 2. **Identify applicable regulation(s)**: - Where is the data subject located? - Which laws apply based on your organization's presence and activities? - What are the specific requirements and timelines? 3. **Verify identity**: - Confirm the requester is who they claim to be - Use reasonable verification measures proportionate to the sensitivity of the data - Do not require excessive documentation 4. **Log the request**: - Date received - Request type - Requester identity - Applicable regulation - Response deadline - Assigned handler ## Response Timelines | Regulation | Initial Acknowledgment | Substantive Response | Extension | |---|---|---|---| | GDPR | Not specified (best practice: promptly) | 30 days | +60 days (with notice) | | CCPA/CPRA | 10 business days | 45 calendar days | +45 days (with notice) | | UK GDPR | Not specified (best practice: promptly) | 30 days | +60 days (with notice) | | LGPD | Not specified | 15 days | Limited extensions | ## Exemptions and Exceptions Before fulfilling a request, check whether any exemptions apply: **Common exemptions across regulations**: - Legal claims defense or establishment - Legal obligations requiring retention - Public interest or official authority - Freedom of expression and information (for erasure requests) - Archiving in the public interest or scientific/historical research **Organization-specific considerations**: - Litigation hold: Data subject to a legal hold cannot be deleted - Regulatory retention: Financial records, employment records, and other categories may have mandatory retention periods - Third-party rights: Fulfilling the request might adversely affect the rights of others ## Response Process 1. Gather all personal data of the requester across systems 2. Apply any exemptions and document the basis 3. Prepare response: fulfill the request or explain why (in whole or part) it cannot be fulfilled 4. If denying (in whole or part): cite the specific legal basis for denial 5. Inform the requester of their right to lodge a complaint with the supervisory authority 6. Document the response and retain records of the request and response