# How requests work

People can ask to see the personal data you hold about them, correct it, erase it, get help withdrawing consent, complain, or name someone to act for them. Requests brings every one of these into one place, checks who's asking, and shows your team what to do next.

## What people can ask for

The DPDP Act gives people rights over their personal data. The Act calls them Data Principals, a term you'll see in a few places in ComplyZero. Each right is a type of request:

- **Access**: to find out what personal data you hold about them, what you do with it and who you've shared it with.
- **Correction**: to fix information that's wrong, incomplete or out of date.
- **Erasure**: to have their data deleted, unless you still need it for the purpose they gave it for, or the law says you must keep it.
- **Withdrawal help**: help withdrawing consent they gave you, such as for marketing messages.
- **Grievance**: a complaint about how you've handled their data or one of their requests.
- **Nomination**: to name someone who can act for them if they die or can no longer act for themselves.

## How requests reach you

However a request comes in, it lands in **Requests**, under **Governance** in the sidebar:

- **Your Trust Centre.** Your public Trust Centre page has a request form anyone can use, once you've published it in [your request settings](#your-request-settings). The person confirms their email address before the request reaches you. See [Publish your Trust Centre](https://www.complyzero.com/docs/trust-centre/publish-your-trust-centre).
- **Your Preference Centre.** People who open their choices in your Preference Centre can make a request from there too.
- **Your own website or app.** If your plan includes API keys, your developers can send requests straight in from your own sign-in.
- **Your team.** When someone asks by phone, email, letter or at your counter, a team member records the request for them. See [Record a request](https://www.complyzero.com/docs/requests/record-a-request).

## Your request settings

Select **Settings**, then **Request Intake**, to decide how requests reach you. The tab is there when your plan includes requests. Anyone who can see the Governance Suite can look, and changing anything needs permission to manage it, which Member and Administrator have.

Your settings live in an intake profile, for your whole organisation or for one website. A profile sets:

- which types of request you accept, and from which kinds of people, such as customers or employees;
- which IDs people can give to help you find them, such as a customer ID;
- how people confirm who they are;
- your target number of days for each type of request;
- which of your systems your team checks for each type of request;
- the wording of your public request form, in each language you offer.

When the wording is ready, select **Review saved draft and preview** to see the form exactly as people will, then **Publish reviewed version**. Until a profile's form is published, your Trust Centre's request page tells visitors it's unavailable and asks them to contact you directly.

## The steps every request goes through

The line at the top of each request always says what happens next and who it's waiting on. Under it, the steps show how far the request has come.

![An access request in progress: the next step says to do the privacy work and send the response, and the steps show Awaiting verification and To review done](https://www.complyzero.com/media/docs/requests/case.36317697.webp)

### Awaiting verification

The person confirms their email address by entering a six-digit code we email them. A request from your Trust Centre does this before it reaches you. For a request your team records, you send the code from the request.

Nothing else can happen until this is done. A phone number or a customer ID helps you find the person's records, but it doesn't prove who's asking, so a request without an email address can't move forward.

### To review

The person has confirmed their email, and the request is waiting for someone on your team to review it and approve or reject it.

### In progress

The request is approved and your team is working on it: finding the person's data in each system that holds it, exporting, correcting or deleting it as the request needs, and then writing the response.

### Completed

You've sent your response. The person can read the outcome and download the response file. If more work turns up later, you can reopen the request.

A request can also end as **Rejected**, with a reason the person can read, or **Cancelled**, when the person withdraws it themselves before you finish.

When a request shows **Waiting for reply**, you've asked the person a question and are waiting for their answer. There's nothing for your team to do until they reply.

## What the person sees

Once they've confirmed their email address, the person has a secure page for their request, linked from our emails. It shows where the request is and when to expect a response, and lets them cancel it until you've finished.

We email them when you ask them a question. When you complete or reject the request, you choose whether we email them. Either way, the outcome is on their request page.

## Target dates

Each type of request has a target: the number of calendar days your team aims to finish within, counted from the day the request comes in. Every type starts at 30 days. You can change them in [your request settings](#your-request-settings), and a grievance can't be given more than 90.

Targets are your own handling goals, not legal deadlines. Asking the person a question doesn't pause the clock. Each request shows its target as **Original operating target**, and open requests that go past it lower your [Readiness Score](https://www.complyzero.com/docs/readiness/check-your-readiness).

## Your list of requests

In the sidebar, under **Governance**, select **Requests**. The counts at the top show how many requests are in each status. Each row shows the request's reference, type, status, when it came in and its **Original operating target**. Select a reference to open the request.

![Requests, with live requests counted by status, including To review, and each request's type, status, created date and target date](https://www.complyzero.com/media/docs/requests/queue.350f4b0b.webp)

Use **Type** and **Status** to narrow the list, and **Clear filters** to see everything again. **Purpose** switches between **Live** requests and **Test** ones. Test requests come from trying out a request form, and stay apart from real ones.

Two things are worth checking every day: requests that are **To review**, because they're waiting on your team, and any request close to its target.

## Give each request a handler

Open the request, then under **Assignment** select **Choose a handler**. Pick the **New handler**, tick **Confirm this new handler** and select **Assign request**. Only team members who can manage requests can be chosen. A handler doesn't stop anyone else from working on the request; it makes clear whose it is.

## Who on your team can do what

What someone can do with requests depends on their role:

| Permission | What it lets them do |
| --- | --- |
| View requests | See the list of requests and follow each one |
| Manage requests | Record requests, send verification codes, choose handlers, ask the person questions, do the privacy work and add internal notes |
| Decide requests | Approve, reject or reopen a request, and decide whether someone may act for another person |
| Release request responses | Write the response and complete the request |

The built-in Member and Administrator roles have all four. Viewer can only view. To split the work, for example so one person prepares responses and a manager approves requests, [make your own role](https://www.complyzero.com/docs/account/invite-your-team#make-your-own-role).

Last checked against the ComplyZero dashboard on 2026-10-24. Source: https://www.complyzero.com/docs/requests/how-requests-work