Data subject rights, retention and breaches

This lesson covers what happens when a person exercises their rights under the Data Protection Act No. 3 of 2021, how long the platform keeps records, and how a personal-data breach is handled. Several periods below are configurable defaults awaiting confirmation by the responsible authorities (the DPO, the records officer, the National Archives). Treat them as the platform's current settings, not as the law.

Data subject requests

A person lodges a request from their own account on the portal ("My data requests"). There are five kinds:

Kind	The person asks to...
`access`	Receive a copy of the data the platform holds about them
`correction`	Correct inaccurate data, for example in an application
`erasure`	Have their data erased
`objection`	Object to a kind of processing
`restriction`	Restrict a kind of processing

Each request gets a reference such as DSR-2026-AB12CD34 (synthetic). A person may lodge up to 5 requests a day and have one open request per kind.

The DPO's steps

Assign the request to a Data Protection Officer.
Verify identity. Record how the requester's identity was checked. Routing or deciding a request before this is
refused (409 DSR_IDENTITY_NOT_VERIFIED).
Route a correction to the office that holds the record. That office has its own working-day clock (default 10
working days) and sees no contact details.
Extend once, before the deadline, with a reason (default at most 30 days).
Decide: granted, partly granted or refused, with reasons. A response letter is generated from approved wording.
Execute an erasure. This needs a second person: the DPO who decided cannot execute it
(409 DSR_SECOND_PERSON_REQUIRED).

The default response period is 30 calendar days. A daily job reminds DPOs of requests due soon and overdue, and statistics per kind show on-time, late and extended requests.

Access requests: the export

For an access request, a background job builds a ZIP of the person's data: their applications, answers, messages sent to them and the documents released to them, as JSON files with a README. It excludes other people's data, officer names, internal notes and documents, case reviews, hashes and sign-in ids.

The ZIP is downloaded only through a signed link minted for the requester, valid for 10 minutes, and the export itself is deleted after 7 days. It is never served by the general file routes.

Erasure: what can and cannot go

An erasure request is worked out by an erasure plan:

Category	Plan
Drafts, unsubmitted applications, preferences, notifications, ended sessions, expired share links, rating comments, optional profile fields	Erase now
Submitted applications, payments, permits, acceptances, handling records, the audit trail	Retain until a date, with the authority that requires it
Anything under a legal hold	Hold (only counted; the letter says "kept for a legal reason")

A full erasure is refused (409 DSR_ERASURE_NOT_POSSIBLE) when anything must be retained or is held; the request can then be partly granted. The account itself is anonymised only when nothing is retained or held.

Objection and restriction

A granted objection or restriction is recorded as the person's privacy preference (for example no AI processing, no non-essential messages, no statistics). Recording the preference is built; making every feature read it is not yet complete.

Retention

The records schedule (defaults awaiting sign-off)

Record	Default retention
Applications	7 years after the decision
Payments	10 years
Permits	7 years after expiry
Acceptances (of notices, declarations)	7 years
Handling records	3 years
Audit trail	Kept

The recycle bin

Deleting a case, document, user, service or estate record moves it to a recycle bin with who deleted it and why. It can be restored with a reason. A purge job removes items after their bin period (defaults: 30 days for cases and documents, 90 days for users, 365 for services and estate records), with these exceptions:

a case that was ever submitted, decided, paid or has a permit is a record, not a draft, and stays;
a document of a decided case, or one an officer verified, stays;
a user row is never removed: its personal data is blanked and a stub stays, because other records point to it;
nothing under an active legal hold is purged.

Breach handling: the incident register

Incidents are recorded in the incident register with a category (service, security, data_integrity, privacy, ai), a severity, an owner and a status: open → investigating → contained → resolved → closed. Closing needs a resolution, and every change is audited.

A privacy incident (personal data involved) starts with the breach-notification checklist and a due time, by default 72 hours from opening (INCIDENT_DPA_NOTIFY_HOURS; the deadline the Data Protection Commissioner expects is still to be confirmed):

Assess the risk to the people whose data is involved.
Contain the breach: stop further disclosure, revoke access.
Tell the Data Protection Officer.
Notify the Data Protection Commissioner, or record why notification is not required.
Tell the people affected when the risk to them is high.
Record the facts, effects and remedial action in the incident.

A security incident gets its own checklist with a 24-hour default for reporting to the national CSIRT under the Cyber Security Act: triage, contain (isolate, rotate credentials, block), report, preserve evidence (including an audit export with chain proof), recover, and record lessons learned.

Example (synthetic)

A partner reports that a developer's laptop holding an export of register data was stolen.

Time	Action
Hour 0	A privacy incident is opened in the incident register, severity high, with a link to the agreement
Hour 1	The custodian terminates the agreement: grants and client are revoked at once. A new agreement and client will follow after review
Hour 4	The DPO assesses the risk: names and company numbers only, no NRCs, because the agreement's fields excluded them
Hour 30	The DPO notifies the Commissioner and records it on the checklist
Day 5	Facts, effects and actions recorded; incident resolved, then closed

Field minimisation in the agreement is what kept the damage small.

Check your understanding

Which five kinds of data subject request can a person lodge?
What must the DPO record before routing or deciding a request?
Why can the DPO who decided an erasure not execute it?
Name two categories an erasure plan retains rather than erases.
What is the first thing to do in a privacy incident, and what is the default notification deadline?