When processing requests, there are two options to select in step 3 of the Request Wizard: Controller and Processor. This article walks through the request flow if you select Processor during this step.
Processor Requests
Most of how a request flows through DataGrail is the same for a Controller or Processor requests, but there are a few differences throughout the lifecycle. The first main difference is how the request is received. For processor requests, you can only receive them via email intake.
Once you have received the email for this request and it has been forwarded into DataGrail, the next difference you’ll see is in step 4 of the Request Wizard. In this step, two email fields are required compared to the one field on a Controller request. The labels for each identify what email should be added:
- Data Subject Email: This is the email address of the data subject and will be utilized when retrieving or deleting data from your systems.
- Controller: This is the email address for the Controller of this data subject’s data. As a processor, you are taking action on this data per the controllers request. The main thing to highlight here is all email communication from DataGrail, including email verifications and the results email, will be sent to this email address.
Note: The Data Subject Email address and the Controller address are required to be different
Once you process the privacy request through the Wizard, it will follow the privacy request lifecycle flow through DataGrail. The data subject’s email will be utilized to retrieve or delete records just as it would with a Controller request.
The next difference you will see while processing the request is within the Request UI. There are some minor differences in the information presented on a Processor request (e.g. the Data Requester’s Email).
After processing the request through the regular privacy request lifecycle, the last difference between the Processor flow and the Controller flow is that the final results email will be sent to the Controller’s email address (listed as the Data Requester Email in the screenshot above).
Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.
