Data Subject request

Your company must have a process for handling data subject rights requests, for example execute the right of access request. Such a request must be handled within a reasonable time frame. According to Article 12 subparagraph 3 of the GDPR, this is “without undue delay and in any event within one month of receipt of the request.” It is recommended to use the Milestone Data Subject Request example to document such requests, since it may be vital in a GDPR case with national data protection authorities.

The video surveillance policy describes the data subject request (see Appendix: Video surveillance policy).