P5.1

The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity’s objectives related to privacy. If access is denied, data subjects are informed of the denial and reason for such denial, as required, to meet the entity’s objectives related to privacy.

Points of Focus

Responds to Data Controller Requests [P]

The entity has a process to respond to data subject requests received from data controllers in accordance with service agreements and privacy objectives. Such process may include authentication of the request, permitting access where appropriate, responding within a reasonable time, and notification if the request is denied.

Authenticates Data Subjects' Identity [P][C]

The identity of data subjects who request access to their personal information is authenticated before they are given access to that information.

Permits Data Subjects Access to Their Personal Information [P][C]

Data subjects are able to determine whether the entity maintains personal information about them and, upon request, may obtain access to their personal information.

Provides Understandable Personal Information Within Reasonable Time [P][C]

Personal information is provided to data subjects in an understandable form, in a reasonable time frame, and at a reasonable cost, if any.

Informs Data Subjects If Access Is Denied [P][C]

When data subjects are denied access to their personal information, the entity informs them of the denial and the reason for the denial in a timely manner, unless prohibited by law or regulation.

Evidence Requests

Area of Focus	Artifact	Description
Privacy	Data Subject Access	Documented evidence of how data subject access requests are handled that includes intake through remediation.

Points of Focus​

Evidence Requests​

Points of Focus

Evidence Requests