--- title: "Keep every GDPR request in one register ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/records-and-data-map/gdpr-request-register id: CMP-81 level: Recommended region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 1181 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Keep every GDPR request in one register with its deadline For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-81 - Level: Recommended - Chapter: [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md) - Rule: Log every request under GDPR Articles 15 to 22 with the right asked for, the channel, the dates received, due and answered, and the answer. Record how you verified the person. Cover restriction, portability, objection and automated decisions, not only access and erasure. - Check: Every request in the support tool tagged as a privacy request has a register row with all fields filled. A daily job fails on a row past its due date without an answer or a recorded extension. An end-to-end test restricts a test person, and the next marketing and analytics jobs skip them. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: The duty to answer, and the export and delete functions, are in [Let people see and delete their data](https://agentwranglers.se/playbook/website/privacy/data-requests.md). This register proves you met it. Support logs each request it receives here, as [Spot data requests in any wording and start the clock on arrival](https://agentwranglers.se/playbook/customer-support/personal-data-requests/recognise-data-requests.md) says. Store the account ID or a hash, never the exported data. Note an extension with its reason and the date you told the person. Report the count, the share answered on time and the oldest open request each month. Article 18 restriction means you keep the data but stop using it, so add a flag that every job and query respects. Article 20 portability means a machine-readable export of what the person gave you. Send it to another service when they ask and it is possible. Article 21 objection to direct marketing always stops it, as [Weigh every legitimate interest in writing](https://agentwranglers.se/playbook/compliance/records-and-data-map/legitimate-interests-assessment.md) says. Article 22 decisions made by software alone need a way to reach a person. Compute the due date as [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/request-deadlines-by-law.md) does. ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### YAML example ```yaml - id: req-2026-0412 right: restriction # access, rectification, erasure, restriction, portability, objection, automated-decision received: 2026-10-02 due: 2026-11-02 extended_to: null answered: 2026-10-09 outcome: restricted ``` ## Sources - [GDPR Articles 12 and 15 to 22](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ## Related rules - WEB-217 [Let people see and delete their data](https://agentwranglers.se/playbook/website/privacy/data-requests.md) in Website - SUP-32 [Spot data requests in any wording and start the clock on arrival](https://agentwranglers.se/playbook/customer-support/personal-data-requests/recognise-data-requests.md) in Customer support - CMP-12 [Weigh every legitimate interest in writing](https://agentwranglers.se/playbook/compliance/records-and-data-map/legitimate-interests-assessment.md) in Compliance and governance - CMP-59 [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/request-deadlines-by-law.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Use Swedish personal identity numbers only when clearly justified](https://agentwranglers.se/playbook/compliance/records-and-data-map/swedish-personal-numbers.md) - Next: [List every cookie and device read with its purpose](https://agentwranglers.se/playbook/compliance/records-and-data-map/device-storage-register.md) - [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md)