prudenceby Runciter
← Compliance guide

What people can ask for

The requests individuals are entitled to make, and the deadlines for answering them.

Article 12

Transparent information and modalities

What it asks for

Information must be given in clear plain language, free of charge, and requests must be answered within one month. That period may be extended by two further months for complex requests, provided the person is told why within the first month.

For example

A customer emails asking for a copy of the personal data held about them. The clock starts on the day the email arrives, not on the day the request reaches the right team.

How Prudence covers it

Every request opens a one month clock on the date received. The extension requires a recorded justification before it is applied, and the remaining days are shown on the dashboard.

Article 13

Information to be provided where data is collected from the data subject

What it asks for

When data is collected directly from a person, they must be told at that moment who is collecting it, why, on what basis, who receives it, how long it is kept and what rights they have.

For example

A contact form on a website needs a short notice next to it, linking to the full privacy notice.

How Prudence covers it

The licensed privacy notice template covers every item Article 13 lists, and each notice is linked to the activities it describes so a change to an activity flags the notice for review.

Article 14

Information where data has not been obtained from the data subject

What it asks for

Where data comes from somewhere else, the same information must be given within a month of obtaining it, or at the first contact, and the source must be named.

For example

A recruiter buys a list of candidate profiles. Each candidate must be told, and told where the profile came from.

How Prudence covers it

Activities record the source of the data. Where the source is not the person, Prudence requires an Article 14 notice to be linked before the activity goes live.

Article 15

Right of access

What it asks for

A person may ask for confirmation that their data is held, a copy of it, and the surrounding information such as purposes, recipients and retention.

For example

A former employee asks for their personnel file. The answer covers the file, the payroll system and any mailboxes holding their data.

How Prudence covers it

An access request lists every system linked to the activities that involve that category of person, so the search covers the same ground each time.

Article 16

Right to rectification

What it asks for

A person may have inaccurate data corrected and incomplete data completed.

For example

A customer reports that their address is wrong in two different systems.

How Prudence covers it

Rectification requests record every system corrected, so the answer shows the correction was applied everywhere rather than in one place.

Article 17

Right to erasure

What it asks for

A person may have data deleted where it is no longer needed, consent is withdrawn, or it was handled unlawfully. There are exceptions, including legal obligations and legal claims.

For example

A newsletter subscriber asks to be deleted. The subscription goes, but the invoice history stays because tax law requires it.

How Prudence covers it

Erasure requests require the outcome per system, and any refusal requires the exception relied on to be recorded and shown to the person.

Article 18

Right to restriction of processing

What it asks for

In certain situations a person may require the data to be kept but not used, for instance while accuracy is being checked.

For example

A customer disputes a debt. The record stays, but collection activity pauses while the dispute is examined.

How Prudence covers it

Restriction is a distinct request type with its own outcome and end date.

Article 19

Notification obligation regarding rectification or erasure

What it asks for

Anyone the data was disclosed to must be told about a correction, deletion or restriction, unless that proves impossible.

For example

A wrong address was passed to a delivery partner. The partner has to be told about the correction too.

How Prudence covers it

Because recipients are linked to activities, Prudence lists who received the data and records that each was notified.

Article 20

Right to data portability

What it asks for

Where handling rests on consent or a contract and is automated, the person may receive their data in a common machine readable format and have it sent elsewhere.

For example

A customer moving to a competitor asks for their order history as a file.

How Prudence covers it

Prudence flags which activities are in scope for portability based on the lawful basis already recorded, so the answer does not have to be worked out from scratch.

Article 21

Right to object

What it asks for

A person may object to handling based on legitimate interests or a public task, and may object to direct marketing at any time with no exceptions.

For example

An objection to marketing must be actioned immediately and permanently.

How Prudence covers it

Objection requests separate marketing objections, which are absolute, from other objections, which require a recorded assessment of compelling grounds.

Article 22

Automated individual decision making, including profiling

What it asks for

Decisions made purely by machine that significantly affect someone are restricted, and where they are allowed the person can ask for human review.

For example

An automatic credit decline needs a route to a human reviewer.

How Prudence covers it

Activities are marked for automated decision making, which requires the logic, the significance and the human review route to be described.

All chaptersNext: What the organisation must put in place ↗