Content library
Informing and data subject requests
Criteria for refusing data subject requests
Privacy
Informing and data subject requests

Criteria for refusing data subject requests

Start free trial

Task description

Criteria for refusing data subject requests

The organization must define and document clear criteria for when a data subject’s request may be refused, such as when it is repetitive, manifestly unfounded, or involves disproportionate effort. These criteria ensure consistent and justifiable decisions based on transparent internal guidelines.

Whenever a request is refused, the data subject must be promptly informed of the decision, including the reason for refusal and their right to challenge or appeal it in accordance with applicable data protection laws.

Requirements connected to the task

Article 3.2: Grounds for refusal
Personal Data Protection Law (Saudi Arabia)

Other tasks from the same security theme

Task name
Priority
Policy
Other requirements
Privacy notices -report publishing and maintenance
Critical
High
Normal
Low
Informing and data subject requests
20
requirements

Examples of other requirements this task affects

12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
13. Information to be provided where personal data are collected from the data subject
GDPR
14. Information to be provided where personal data have not been obtained from the data subject
GDPR
18.1.4: Privacy and protection of personally identifiable information
ISO 27001
ID.GV-3: Legal and regulatory requirements
NIST
See all related requirements and other information from tasks own page.
Go to >
Privacy notices -report publishing and maintenance
Transparency in advanced data processing
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 4.5: Enhanced transparency for high-risk and automated data processing
PDPL
See all related requirements and other information from tasks own page.
Go to >
Transparency in advanced data processing
Self-service channel for data subjects
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 5.1: Right of access to personal data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Self-service channel for data subjects
Publication and maintenance of privacy notice reports
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 3.1: Procedure upon receipt of request from the Data Subject
PDPL
See all related requirements and other information from tasks own page.
Go to >
Publication and maintenance of privacy notice reports
Use of unique identifiers for data separation
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

Article 5.2: Ensuring non-disclosure
PDPL
Article 6: Right to request access to personal data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Use of unique identifiers for data separation
Documentation of personal data processing purposes
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

Article 4.1-4: Right to be informed about the collection of personal data
PDPL
Article 3.1: Procedure upon receipt of request from the Data Subject
PDPL
See all related requirements and other information from tasks own page.
Go to >
Documentation of personal data processing purposes
Supporting data subject requests with administrative and technical measures
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 3.1: Procedure upon receipt of request from the Data Subject
PDPL
See all related requirements and other information from tasks own page.
Go to >
Supporting data subject requests with administrative and technical measures
Handling requests and consent from legal guardians
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

Article 13: Processing personal data through legal guardians
PDPL
Article 3.3: Exercising of rights by a legal guardian
PDPL
See all related requirements and other information from tasks own page.
Go to >
Handling requests and consent from legal guardians
Management of credit data consent and disclosure
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 27: Processing credit data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Management of credit data consent and disclosure
Communication channels for data subject requests
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 10: Means of communication
PDPL
See all related requirements and other information from tasks own page.
Go to >
Communication channels for data subject requests
Criteria for refusing data subject requests
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 3.2: Grounds for refusal
PDPL
See all related requirements and other information from tasks own page.
Go to >
Criteria for refusing data subject requests
Communication with data subjects lacking legal capacity
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 4.7: Provision of information in an appropriate language
PDPL
See all related requirements and other information from tasks own page.
Go to >
Communication with data subjects lacking legal capacity
Establishing a data collection transparency procedure
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

Article 4.1-4: Right to be informed about the collection of personal data
PDPL
Article 4.5: Enhanced transparency for high-risk and automated data processing
PDPL
See all related requirements and other information from tasks own page.
Go to >
Establishing a data collection transparency procedure
Processing personal data collected from third-party sources
Critical
High
Normal
Low
Informing and data subject requests
4
requirements

Examples of other requirements this task affects

Article 4.1-4: Right to be informed about the collection of personal data
PDPL
Article 20.4: Necessary care and guarantees to ensure the privacy of third parties
PDPL
Article 15: Processing data from third parties
PDPL
Article 20.1-2: Disclosure of personal data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Processing personal data collected from third-party sources
Guidelines for marketing and awareness communications
Critical
High
Normal
Low
Informing and data subject requests
3
requirements

Examples of other requirements this task affects

Article 28.1-2: Processing data for advertising or awareness purposes
PDPL
Article 29: Direct marketing
PDPL
Article 28.3: Controller obligations when advertising
PDPL
See all related requirements and other information from tasks own page.
Go to >
Guidelines for marketing and awareness communications
Procedure for managing data protection complaints
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

Article 37: Filing and processing complaints
PDPL
See all related requirements and other information from tasks own page.
Go to >
Procedure for managing data protection complaints
Process for ceasing data processing after consent withdrawal
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

Article 12.1-3: Withdrawal of consent
PDPL
Article 12.4-5: Appropriate controller measures upon withdrawal of consent
PDPL
See all related requirements and other information from tasks own page.
Go to >
Process for ceasing data processing after consent withdrawal
Personal data verification and correction procedure
Critical
High
Normal
Low
Informing and data subject requests
5
requirements

Examples of other requirements this task affects

Article 43: Individual right to request corrections
CSL (China)
Article 7.2: Supporting documentation or evidence
PDPL
Article 7.3: Notification of concerned parties
PDPL
Article 22.1-4: Correction of personal data
PDPL
Article 22.5: Measures to avoid the impact of processing inaccurate, incomplete, or outdated personal data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Personal data verification and correction procedure
Updating requested amends
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Updating requested amends
Denial issuing
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Denial issuing
PHI disclosure accounting
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
PHI disclosure accounting
Safeguards to protect the confidentiality of group health plans
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Safeguards to protect the confidentiality of group health plans
Amendments from other covered entities
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Amendments from other covered entities
Grant access to inspect and obtain PHI
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Grant access to inspect and obtain PHI
Amendment request timeliness
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Amendment request timeliness
Record keeping documentation
Critical
High
Normal
Low
Informing and data subject requests
3
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Record keeping documentation
Record of disclosures of protected health information
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Record of disclosures of protected health information
Amendment denial disclosure
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Amendment denial disclosure
Management of access rights to PHI
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Management of access rights to PHI
Amendment disagreement disclosure
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Amendment disagreement disclosure
Review and redirection facilitation
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Review and redirection facilitation
Communications and disclosures of confidential information
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Communications and disclosures of confidential information
Amendment notification
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Amendment notification
Disclosure of protected health information
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Disclosure of protected health information
Amendment decision criteria
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Amendment decision criteria
Ability to request restriction of the processing of personal data
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Ability to request restriction of the processing of personal data
PHI amend requests
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
PHI amend requests
Ensure a compliant and updated Notice of Privacy Practices (NPP)
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Ensure a compliant and updated Notice of Privacy Practices (NPP)
Providing Notice of Privacy Practices (NPP) to individuals
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Providing Notice of Privacy Practices (NPP) to individuals
Access requests to PHI
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

5.16: Identiteitsbeheer
NEN 7510
See all related requirements and other information from tasks own page.
Go to >
Access requests to PHI
Disclose PHI to family, caregivers, and in emergencies
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Disclose PHI to family, caregivers, and in emergencies
Manage authorizations and core validity requirements for PHI
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Manage authorizations and core validity requirements for PHI
NPP delivery and acknowledgment guidelines
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
NPP delivery and acknowledgment guidelines
Process for receiving and handling data subject requests
Critical
High
Normal
Low
Informing and data subject requests
32
requirements

Examples of other requirements this task affects

15. Right of access by the data subject
GDPR
16. Right to rectification
GDPR
18. Right to restriction of processing
GDPR
19. Notification obligation regarding rectification or erasure of personal data or restriction of processing
GDPR
21. Right to object
GDPR
See all related requirements and other information from tasks own page.
Go to >
Process for receiving and handling data subject requests
Data erasure processes and the "right to be forgotten"
Critical
High
Normal
Low
Informing and data subject requests
7
requirements

Examples of other requirements this task affects

17. Right to erasure (‘right to be forgotten’)
GDPR
A.7.3.6: Access, correction and/or erasure
ISO 27701
A.8.2.3: Marketing and advertising use
ISO 27701
TSU-19.4: Rekisteröidyn oikeudet - Tietojen oikaiseminen, poistaminen, siirtäminen, käsittelyn rajoittaminen ja vastustaminen
Julkri
P4.3: Secure disposal of personal information
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Data erasure processes and the "right to be forgotten"
Documentation of personal data sources for data systems
Critical
High
Normal
Low
Informing and data subject requests
5
requirements

Examples of other requirements this task affects

14. Information to be provided where personal data have not been obtained from the data subject
GDPR
A.7.3.3: Providing information to PII principals
ISO 27701
TSU-19.2: Rekisteröidyn oikeudet - Läpinäkyvä informointi
Julkri
P3.1: Collection of personal information is consistent with objects related to privacy
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Documentation of personal data sources for data systems
Informing the controller of the processors of personal data
Critical
High
Normal
Low
Informing and data subject requests
8
requirements

Examples of other requirements this task affects

A.8: Openness, transparency and notice
ISO 27018
A.8.1: Disclosure of sub-contracted PII processing
ISO 27018
A.8.5.6: Disclosure of subcontractors used to process PII
ISO 27701
A.8.5.7: Engagement of subcontractor to process PII
ISO 27701
A.8.5.8: Change of subcontractor to process PII
ISO 27701
See all related requirements and other information from tasks own page.
Go to >
Informing the controller of the processors of personal data
Listing of non-recurring data disclosures and contractual commitment to informing them to customers
Critical
High
Normal
Low
Informing and data subject requests
7
requirements

Examples of other requirements this task affects

A.6: Use, retention and disclosure limitation
ISO 27018
A.6.1: PII disclosure notification
ISO 27018
A.6.2: Recording of PII disclosures
ISO 27018
A.8.5.1: Basis for PII transfer between jurisdictions
ISO 27701
A.8.5.4: Notification of PII disclosure requests
ISO 27701
See all related requirements and other information from tasks own page.
Go to >
Listing of non-recurring data disclosures and contractual commitment to informing them to customers
Process for data subjects to edit or cancel a consent
Critical
High
Normal
Low
Informing and data subject requests
5
requirements

Examples of other requirements this task affects

A.7.3.4: Providing mechanism to modify or withdraw consent
ISO 27701
P2.1: Communication of choices about personal information to data subjects
SOC 2
Article 13.1(.2.m): Removing data
CRA
Article 12.1-3: Withdrawal of consent
PDPL
Article 12.4-5: Appropriate controller measures upon withdrawal of consent
PDPL
See all related requirements and other information from tasks own page.
Go to >
Process for data subjects to edit or cancel a consent
Process for data subjects to object processing
Critical
High
Normal
Low
Informing and data subject requests
3
requirements

Examples of other requirements this task affects

A.7.3.5: Providing mechanism to object to PII processing
ISO 27701
TSU-19.4: Rekisteröidyn oikeudet - Tietojen oikaiseminen, poistaminen, siirtäminen, käsittelyn rajoittaminen ja vastustaminen
Julkri
Article 4.6: Processing personal data for other purposes
PDPL
See all related requirements and other information from tasks own page.
Go to >
Process for data subjects to object processing
Process for data subjects to rectify inaccurate personal data
Critical
High
Normal
Low
Informing and data subject requests
5
requirements

Examples of other requirements this task affects

A.7.3.6: Access, correction and/or erasure
ISO 27701
TSU-19.4: Rekisteröidyn oikeudet - Tietojen oikaiseminen, poistaminen, siirtäminen, käsittelyn rajoittaminen ja vastustaminen
Julkri
P5.2: Correction of personal information
SOC 2
Article 7.1: Right to request correction of personal data
PDPL
Article 22.5: Measures to avoid the impact of processing inaccurate, incomplete, or outdated personal data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Process for data subjects to rectify inaccurate personal data
Informing third parties about relevant changes to personal data
Critical
High
Normal
Low
Informing and data subject requests
1
requirements

Examples of other requirements this task affects

A.7.3.7: PII controllers' obligations to inform third parties
ISO 27701
See all related requirements and other information from tasks own page.
Go to >
Informing third parties about relevant changes to personal data
Securely delivering a copy of data subject's personal data
Critical
High
Normal
Low
Informing and data subject requests
4
requirements

Examples of other requirements this task affects

A.7.3.8: Providing copy of PII processed
ISO 27701
TSU-19.3: Rekisteröidyn oikeudet - Oikeus saada pääsy tietoihin
Julkri
Article 6: Right to request access to personal data
PDPL
Article 5.1: Right of access to personal data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Securely delivering a copy of data subject's personal data
Yhteisrekisterinpitäjänä toimiminen
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

TSU-03: Yhteisrekisterinpitäjät
Julkri
58: Yhteisrekisterinpitäjyystilanteiden tunnistaminen
Digiturvan kokonaiskuvapalvelu
See all related requirements and other information from tasks own page.
Go to >
Yhteisrekisterinpitäjänä toimiminen
Identification of the rights available to the data subject
Critical
High
Normal
Low
Informing and data subject requests
6
requirements

Examples of other requirements this task affects

TSU-19.1: Rekisteröidyn oikeudet - Rekisteröidyn käytettävissä olevien oikeuksien tunnistaminen
Julkri
P5.1: Granting access to stored personal data
SOC 2
§ 19: Behandling av personopplysninger
NIS2 NO
Article 7.1: Right to request correction of personal data
PDPL
Article 3.1: Procedure upon receipt of request from the Data Subject
PDPL
See all related requirements and other information from tasks own page.
Go to >
Identification of the rights available to the data subject
Notification channel for the registered for reporting privacy problems
Critical
High
Normal
Low
Informing and data subject requests
2
requirements

Examples of other requirements this task affects

P8.1: Periodic monitoring of privacy compliance
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Notification channel for the registered for reporting privacy problems
Ensuring the timeliness of privacy communication
Critical
High
Normal
Low
Informing and data subject requests
10
requirements

Examples of other requirements this task affects

12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
18.1.4: Privacy and protection of personally identifiable information
ISO 27001
18.2.2: Compliance with security policies and standards
ISO 27001
A.7.3.2: Determining information for PII principals
ISO 27701
TSU-19.2: Rekisteröidyn oikeudet - Läpinäkyvä informointi
Julkri
See all related requirements and other information from tasks own page.
Go to >
Ensuring the timeliness of privacy communication
Testing the clarity of privacy communications
Critical
High
Normal
Low
Informing and data subject requests
5
requirements

Examples of other requirements this task affects

12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
TSU-19.2: Rekisteröidyn oikeudet - Läpinäkyvä informointi
Julkri
64: Informointikäytäntöjen määrittäminen
Digiturvan kokonaiskuvapalvelu
P1.1: Providing notice to data subjects about privacy practices
SOC 2
Article 4.7: Provision of information in an appropriate language
PDPL
See all related requirements and other information from tasks own page.
Go to >
Testing the clarity of privacy communications
Ability to provide the data subject with personal data ready for transfer
Critical
High
Normal
Low
Informing and data subject requests
6
requirements

Examples of other requirements this task affects

20. Right to data portability
GDPR
A.7.3.8: Providing copy of PII processed
ISO 27701
TSU-19.4: Rekisteröidyn oikeudet - Tietojen oikaiseminen, poistaminen, siirtäminen, käsittelyn rajoittaminen ja vastustaminen
Julkri
9.6.1: Management of data subject requests
TISAX
Article 5.1: Right of access to personal data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Ability to provide the data subject with personal data ready for transfer
Clear communication about the effects of consent
Critical
High
Normal
Low
Informing and data subject requests
3
requirements

Examples of other requirements this task affects

P2.1: Communication of choices about personal information to data subjects
SOC 2
Article 12.1-3: Withdrawal of consent
PDPL
Article 11.1-2: Processing consent
PDPL
See all related requirements and other information from tasks own page.
Go to >
Clear communication about the effects of consent
Communication methods for refusing to implement data protection requests
Critical
High
Normal
Low
Informing and data subject requests
3
requirements

Examples of other requirements this task affects

P5.1: Granting access to stored personal data
SOC 2
P5.2: Correction of personal information
SOC 2
Article 3.2: Grounds for refusal
PDPL
See all related requirements and other information from tasks own page.
Go to >
Communication methods for refusing to implement data protection requests

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Start free trial
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.
Effortless compliance improvement
Widest framework library in EU
Extensive support

Start your compliance journey

Use in MS Teams or use your browser with Slack integration.
Risk free trial. No credit card required. Stop at any time.

Start free trial
Book a meeting
How it works?
SummarySecurity tasks and assuranceDocumentation workflowsEmployee guidelinesReporting templatesTrust center
Use cases
By frameworkAll frameworksISO 27001NIS2 directiveNIST CSFCSA CCMISO 27701GDPRISO 27017ISO 27018
By methodCyber risk managementEmployee awarenessCompliance reportingControl managementAsset managementPrivacy managementVendor assessmentsInternal audits
Resources
AcademyWebinarsBlogHelp articlesVideo coursesContent libraryGuidesNewsletterLeave a reviewPartner programTeamTerms of usePrivacy policy
Contact us
+358 10 231 6010
team@cyberday.ai
App works in:
Known in Finland as Digiturvamalli
© Cyberday Inc. Kalevantie 2 33100 Tampere, Finland
Cyberday.ai - Improve and certify your cyber security