Agent Wranglers

CMP-81Recommended EU law

Keep every GDPR request in one register with its deadline

Log every request under GDPR Articles 15 to 22 with the right asked for, the channel, the dates received, due and answered, and the answer. Record how you verified the person. Cover restriction, portability, objection and automated decisions, not only access and erasure.

By Agent Wranglers. Updated .

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

The duty to answer, and the export and delete functions, are in Let people see and delete their data. This register proves you met it. Support logs each request it receives here, as Spot data requests in any wording and start the clock on arrival says. Store the account ID or a hash, never the exported data. Note an extension with its reason and the date you told the person. Report the count, the share answered on time and the oldest open request each month. Article 18 restriction means you keep the data but stop using it, so add a flag that every job and query respects. Article 20 portability means a machine-readable export of what the person gave you. Send it to another service when they ask and it is possible. Article 21 objection to direct marketing always stops it, as Weigh every legitimate interest in writing says. Article 22 decisions made by software alone need a way to reach a person. Compute the due date as Track request deadlines by law does.

Examples

YAML example

- id: req-2026-0412
  right: restriction        # access, rectification, erasure, restriction, portability, objection, automated-decision
  received: 2026-10-02
  due: 2026-11-02
  extended_to: null
  answered: 2026-10-09
  outcome: restricted

How to check

Every request in the support tool tagged as a privacy request has a register row with all fields filled. A daily job fails on a row past its due date without an answer or a recorded extension. An end-to-end test restricts a test person, and the next marketing and analytics jobs skip them.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/records-and-data-map/gdpr-request-register">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.