Data principal rights and breach readiness
Be ready for the request, and for the bad day.
People can ask what you hold, correct it, have it erased, complain, and nominate someone to act for them. And if personal data is exposed, you must tell the Data Protection Board and the people affected. We set up both, then test them.
No fee for the first conversation.
Why it matters
Both are time-bound and visible. The usual failure is not a missing policy: it is that nobody knows who does what when something goes wrong, or how to confirm who is asking without collecting more of their data.
What we cover
Request intake
Forms, email templates and scripts for every channel people use to ask.
Identity verification
How to confirm who is asking without collecting more than you need.
Response playbooks
Step-by-step procedures for access, correction, erasure, nomination and complaints, with templates.
Request log
An audit trail that shows each request was handled on time.
Breach procedure
Detect, contain, escalate, assess, notify, with a named response team and a live contact tree.
Notification templates
Wording for the Board and for affected people.
Tabletop test
A practice breach, so the plan is tried before it is needed.
What you receive
- Rights-handling procedures and response templates
- An identity-verification approach that does not over-collect
- A request log your team can keep
- A breach response procedure with a named team and contact tree
- Notification templates for the Board and for affected people
- Training for the teams who would handle both, and a tabletop test of the breach plan
Typical timeline. About 3 to 4 weeks, including the tabletop test.
How it works
- 01
Inventory rights and channels
We list the rights that apply to you and every way people can ask.
- 02
Design the workflows
We map intake, verification, action and response, and the breach path from detection to notice.
- 03
Draft templates and plan
Response letters, the breach procedure and the contact tree.
- 04
Train and test
We train your team and run a practice breach.
Who it is for
- Consumer-facing apps and platforms
- Businesses that hold employee or customer data
- Organisations with no breach contact list or escalation route
- Teams that already handle requests under another privacy law and want to adapt
What it does not include
- Incident response or forensics during a live breach. We help you prepare; we are not an emergency response team
- Software for managing requests, though we will help you choose how manual or automated to be
Questions
How fast must we tell people about a breach?
The Rules ask you to inform affected people without delay, and to intimate the Board without delay with fuller details within 72 hours. We build the plan so that clock can be met.
How do we verify someone without collecting more data?
We use what you already hold, such as a logged-in account or a registered email, and set a minimum check for anything else.
Can this work with a ticketing tool?
Yes. The process works manually, in a shared inbox or in a ticketing tool; we help you pick what fits your volume.
Do you run the breach test yourselves?
Yes, as part of the work. It shows where the contact list or hand-offs fail before a real incident does.
Other DPDP services
- DPDP readiness reviewCheck the evidence behind your answers and turn the free score into a verified baseline, with owners and dates.
- Notices, consent and grievancePlain-language notices, consent flows you can prove, and a grievance route people can actually use.
- Data mapping and retentionKnow what personal data you hold, where it flows, who else touches it, and when it gets deleted.
General advisory, not legal advice or a legal opinion. Where a point needs a lawyer’s view, we will say so. Last reviewed 6 October 2026.