Privacy requests

Open Admin → Privacy requests to record the handling of a data-subject request. For example, a former employee asks for a copy of their data: track the decisions and evidence here while carrying out the work in the relevant systems. The page covers access, portability, correction, restriction, erasure, objection and human review. It does not itself decide the request, erase data, prepare a legally approved response or deliver it.

Access and source records

This is a tenant-level workflow. privacy_rights_request.read permits reads; .manage permits intake, workflow facts and action evidence; .decide permits human decisions; .export permits minimized evidence download. Complete additional authentication when requested.

Keep original request content, identity documents, advice and responses in your approved restricted case system. Ennea stores request/subject lookup references and authority/evidence references as tenant-keyed digests. Use opaque references, not request text, names, addresses or credentials.

Keep the generated Ennea case reference with the original request in that restricted case system. The original lookup references cannot be reopened or recovered from their digests. The list shows the 100 most recently updated cases; search and status filters apply to this loaded list.

Register a request

1. Open Admin → Privacy requests → New request.
2. Select every applicable request type and intake source.
3. Enter request/ticket and subject lookup references, subject category and the applicable data categories, such as contact details, files or audit records.
4. Set received time, the approved operational response target and its basis.
5. Set retention-review time and the applicable evidence retention policy.
6. Create the case and inspect its reference and initial closure blockers.

Prefilled response and retention dates are form defaults, not legal determinations. Confirm them against the responsible person's procedure before saving. The case creates required action obligations for the request types and secure response delivery.

Record decisions in order

In Authorized human decisions, choose the decision, outcome and Reason, enter the external Authority reference, then select Record decision. Records are append-only and attributed to the signed-in person.

Resolve identity verification first, then controller/processor routing and scope. Record any applicable objection, automated-decision review, refusal or extension decision. An extension requires its later response target. Ennea checks the recorded prerequisites but does not supply the human assessment.

Use the nonterminal status selector to track intake, identity verification, assessment, fulfilment, awaiting external evidence and ready for response. A later decision can correct earlier assessment without deleting its evidence.

Record completed actions

Actual locating, exporting, correcting, restricting or erasing runs through the applicable governed system or provider workflow. Recording an action here does not execute it.

1. Open Evidence.
2. Select the Task to record from the case's existing obligations.
3. Use that task's bound system/provider, action type and evidence requirements. These are determined by the obligation when the case is created and are not reassigned freely.
4. Select registered, completed, failed or not applicable, and provide the opaque evidence reference required for the result.
5. Choose Record evidence and inspect its integrity status.

Record external-provider evidence against the correct obligation. Do not mark a provider task complete merely because the Ennea-local action succeeded. If a needed obligation was omitted at intake, involve the authorized administrator; a new arbitrary action key cannot repair an immutable binding. Integrity verified means the stored record matches its integrity digest; it does not verify the external work or its content.

Final response and closure

Review the final response through the approved human process and record its decision. Deliver through the approved secure channel, then select Deliver the approved response securely under Evidence and record Completed with its delivery evidence reference after that decision. Not applicable is unavailable for this task. The tracker does not send the response.

Expand Open requirements: … for remaining identity, routing, scope, required actions, external evidence, final-response, integrity and request-specific decisions. Ready to close appears when those requirements are satisfied. Use a Case closure decision with Close; the service derives completed, refused or cancelled from the recorded final response. Reopening is another human decision.

Retention controls

Choose Retention, hold or anonymization control in the decision form and record the authorized outcome and authority reference. Retain until review, Place hold and Record exception require Retention review at. The date must be after the request's receipt. Release hold and Authorize anonymization do not require that date.

These controls remain available on completed, refused and cancelled cases. Reopen a closed case before adding other decisions or action evidence. A retention review date records the next review; it does not schedule deletion, and an anonymization authorization does not itself run anonymization.

For a Deadline extension → Extend decision, supply an Extended response target later than the current effective response target. The form sends that date only for an extension, and the retention review date only for retention outcomes that require it.

Export and recovery

Export minimized evidence downloads confidential structured case evidence, obligation bindings, decisions/actions, blockers and integrity information. It omits raw lookup references and much identifying/narrative material. It is not the data-subject disclosure export or final response.

For a failed append, inspect the current decision/action history before repeating. For closure blockers, resolve the named requirement and exact action key. For an integrity failure, stop relying on the affected evidence and ask the authorized administrator to investigate; do not append invented completion. For access failure, check tenant grants and authentication.

See Security incidents, users and roles, System events and support.