Data Subject Rights and Request Handling Questions

Operationalizing individual rights: access, rectification, erasure, portability, restriction, and objection requests. Covers identity verification, response timelines, locating data across systems to fulfill a request, and handling edge cases and exemptions. Includes designing systems that can execute deletion and export reliably at scale.

HardTechnical

83 practiced

Describe a product and engineering plan to support GDPR and CCPA requests: subject access requests, right to be forgotten (data deletion), consent management, data portability, and record-keeping. Include API endpoints or admin UX, audit trails, and internal processes for processing requests.

Sample Answer

Situation & goal: Build a scalable product + engineering program enabling GDPR/CCPA data-subject-requests (DSRs): subject access (SAR), right to be forgotten (deletion), consent management, portability, and legally-required record-keeping — minimizing risk and operational cost while preserving user trust.

Product plan (what, why, priority):- Core features (MVP, 8–12 weeks): DSR intake portal (self-serve + admin), authenticated SAR/Deletion requests, export/portability bundles, consent management UI, audit log & retention policy. Priority = compliance + low-touch automation.- Next (12–24 weeks): Granular dataset mapping, automated downstream purge connectors, workflow SLA dashboard, reporting for legal/ops.

Engineering design (how):- Data mapping: Create a Privacy Data Catalog linking data subjects → data stores, schemas, retention. Store metadata in a canonical Privacy Graph DB.- Request lifecycle service: central microservice handling requests, state machine (Received, Verified, In Progress, Completed, Denied), idempotency keys, retry.- Connectors: pluggable adapters for services (RDBMS, S3, analytics, third-party APIs) to collect, delete, or redact data.- Consent store: immutable ledger (append-only) storing consent events (who, when, scope, source). Expose SDKs for frontend/backends.- Audit trail: tamper-evident audit log (write-ahead log + hash chaining + retained per legal retention) with export for regulators.

API endpoints (examples):- POST /dsr/requests — submit request (type, subject id, proof)- GET /dsr/requests/{id} — status + timeline- POST /dsr/requests/{id}/verify — attach verification evidence- POST /dsr/requests/{id}/action — run export/delete/redact- GET /consent/{subjectId} — fetch consents- POST /consent/{subjectId} — record consent change- GET /audit/requests/{id} — immutable audit record (admin, read-only)

Admin UX & ops:- Admin console: queue with SLA indicators, request detail (affected systems, recommended actions), one-click “run connectors” with dry-run option, manual override, canned responses, escalation flows.- Verification workflow: integrated identity verification options (email OTP, OAuth, KBA) configurable by risk level.- Reporting: metrics (time-to-verify, time-to-complete, volume by type), compliance SLA dashboard, exportable compliance packages.

Security & privacy controls:- Least privilege access, field-level encryption, key management, MFA for admins.- Rate-limiting, anti-abuse checks, fraud detection for forged requests.

Audit, retention & legal:- Keep full immutable audit trail for each DSR: timestamps, actor, actions, outputs (hash of exported dataset), legal reason if denied — retention policy configurable (meet GDPR/CCPA minimums).- Data portability output: structured JSON/CSV with schema, hashed file for integrity, secure expiring download link.- Deletion records: store deletion proof (hash of deleted record snapshot + connector logs) without retaining subject personal data beyond legally required metadata.

Internal processes:- Intake triage: automated verification -> auto-complete low-risk SAR/export/delete -> manual review for complex requests (e.g., conflicting rights, legal holds).- Escalation to legal for holds, conflicting requests, or data retention exceptions.- SLAs: configure per regulation (e.g., GDPR 30 days) with escalation thresholds and audit alerts.- Training: quarterly compliance training for support & ops; playbooks for common request types.- Post-incident: blameless reviews and update connectors/tests.

Testing & monitoring:- End-to-end tests for each connector, dry-run deletion simulations, synthetic DSR load testing.- Monitoring: alerts on increasing denial rates or missed SLAs, connector failures, suspicious request patterns.

Success metrics:- Compliance coverage (% of systems mapped)- Automated completion rate (% DSRs auto-resolved)- Median time-to-complete vs SLA- Number of manual interventions per 100 DSRs

Trade-offs & risks:- Full automation vs false deletions — mitigate with verification, dry-runs, and legal holds.- Breadth-first mapping vs depth — start with high-risk/high-volume systems.

This plan balances product usability, engineering safety, and legal rigor to operationalize GDPR/CCPA responsibilities while minimizing ongoing manual work.

Unlock Full Question Bank

Get access to hundreds of Data Subject Rights and Request Handling interview questions and detailed answers.

Join thousands of developers preparing for their dream job.