Data Access Request Procedures
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document defines the written procedures for processing Data Subject Access Requests (DSARs) submitted by individuals seeking access to their personal information held by QA Touch. These procedures ensure timely, accurate, and lawful responses in compliance with GDPR Article 15, CCPA Right to Know, and PIPEDA. Supports SOC 2 Privacy criterion P6.1 (Access to Personal Information).
2. Types of Access Requests Covered
- Right of Access (GDPR Art. 15): request for a copy of personal data held and information about its processing.
- CCPA Right to Know: request for categories and specific pieces of personal information collected, sold, or disclosed in the previous 12 months.
- PIPEDA Access Request: access to personal information held and information on how it has been used.
- Internal employee requests: QA Touch employee access requests for their own HR data are handled separately by HR.
3. DSAR Process — Step by Step
| # | Activity | Responsible Party | Timeline |
|---|---|---|---|
| 1 | Data subject submits request via the online Data Request Form [VERIFY URL] or by email to privacy@qatouch.com [VERIFY]. | Data Subject | Anytime |
| 2 | Automated acknowledgement email sent confirming request receipt and unique DSR ID. | System (automated) | Within 24 hours of submission |
| 3 | Request logged in DSR tracking system: requestor name, contact, request date, request type, DSR ID, assigned handler. | Privacy / Compliance Team | Within 24 hours of receipt |
| 4 | Identity verification initiated per Section 4. If identity cannot be confirmed with submitted information, additional verification requested from requestor. | Privacy / Compliance Team | Within 5 business days of receipt |
| 5 | On identity confirmation: scope of request assessed; relevant data systems identified; data extraction coordinated with Engineering / DBA. | Privacy / Compliance Team + Engineering | Within 15 calendar days of identity verification |
| 6 | Extracted data reviewed for: completeness, accuracy, presence of third-party personal data requiring redaction, and applicable exemptions. | Privacy / Compliance Team + Legal | Within 20 calendar days of identity verification |
| 7 | Response package prepared: data in portable format (JSON, PDF, or CSV); covering letter explaining data provided and any exemptions applied with legal basis. | Privacy / Compliance Team | Within 25 calendar days of identity verification |
| 8 | Response delivered to data subject via secure mechanism (encrypted email or secure file transfer link). Verbal responses always supplemented with written confirmation. | Privacy / Compliance Team | Within 30 calendar days of identity verification (GDPR Art. 12) |
| 9 | DSR log updated: completion date, data provided summary, exemptions applied, delivery method, confirmation of receipt. | Privacy / Compliance Team | On completion |
| 10 | If request cannot be completed within 30 days (complexity or volume): notify data subject by day 30 with reason for delay; complete within 90 days total (GDPR Art. 12(3)). | Privacy / Compliance Team | Day 30 if extension needed |
4. Identity Verification Procedure
QA Touch must verify the identity of every data subject before releasing personal information to prevent unauthorised disclosure.
| Requestor Type | Verification Method | Additional Steps if Required |
|---|---|---|
| Registered QA Touch user | Verified if request submitted from the registered email address; or if user is authenticated in their QA Touch account when submitting. | If email mismatch: one-time verification code sent to registered email; requestor must confirm receipt. |
| Former QA Touch user (account closed) | Verified via email confirmation to last-registered email address on file. | If email inaccessible: government-issued ID may be requested for high-sensitivity data (redacted copy, stored securely, deleted after verification). |
| Individual whose data was entered by a customer (B2B context) | Requestor provides: full name, email, name of the QA Touch customer (employer) workspace. QA Touch verifies against workspace user records. | May refer requestor to the controller (their employer) for workspace data held within employer’s account. QA Touch provides platform-level data only. |
| Third party acting on behalf of data subject | Written authorisation (signed) from the data subject must be provided before any data is released. | Power of attorney document accepted for individuals who cannot act for themselves. |
5. Exemptions and Limitations
- Third-party data: if the requested data contains personal information about other individuals, that data is redacted before disclosure.
- Legal hold: data subject to an active legal hold, regulatory requirement, or law enforcement request may be withheld; the requestor is notified that some data has been withheld and the general reason.
- Manifestly unfounded or excessive requests: QA Touch may charge a reasonable fee or refuse to act; the requestor is notified within 30 days.
- Trade secrets or confidential business information embedded in data: may be redacted with reason provided.
6. DSR Record Retention
- All DSAR records (request, verification, response, closure) retained for 3 years after completion.
- DSAR log audited annually by the Privacy/Compliance Officer; reported to the CISO.