VCDPA Step 02: Access Requests for VCDPA

Under CPDA, your business must provide consumers with the ability to request access their personal data and respond tho their requests within 45 days. You may also request a 45-day extension for a legitimate reason or if a delay occurs in processing their request.

Here’s how to enable consumers to exercise their data subject rights.

1. Provide users with ways to submit their access requests

In order to fulfill this obligation, you must provide your consumer in your Privacy Notice of one or more secure ways to submit a request. Typically these are:

• A form or privacy center to automatically accept requests from consumers.
• An email address or customer support system to intake consumer requests.

2. Collect information necessary to identify user

As the business receiving the request, you are responsible for verifying the identity of the consumer.

To minimize privacy risks, you should not request additional information that you do not already have to verify their identity. For example, if you don’t already have their driver’s license, don’t ask for it to process privacy requests.

The most common method to verify a user’s identity is sending a verification code to their email address or phone number. This MFA code allows you to ensure that the consumer making the request is who they say they are.

3. Retrieve users' personal data from your systems

After approving users' requests, you must then retrieve all of their data across your entire organization and present a copy of it to them.

If you are doing this manually, be careful to ensure you are not returning confidential company information, data belonging to another user, or any non-personal, non-essential information.

The access request process can be costly, labor-intensive, and risky. Therefore we strongly recommend using an automated system such as the Fides privacy engineering and intelligence platform to automate this process end-to-end for you.