Procedure template for handling data subject requests
- Art. 25-29 FADP
- Art. 12 GDPR
- Art. 15-22 GDPR
- About 15 minutes
- Italiano · Deutsch · Français · English
In brief
Sets how you receive, check and handle the requests by which people exercise their rights (access, rectification, deletion, objection). It lets you reply correctly and within the statutory time limit.
- Who it is for
- Internal use: those who receive requests (front office, customer service) and those who reply.
- To decide first
- No fields to fill in: the text uses your organisation's details. Read through the channels for receiving requests and the roles and adapt them to how you work.
- Afterwards
- Make it known to those in contact with customers and employees and keep the request forms and the standard replies ready.
What it contains
- 1Purpose and scope
- 2Roles
- 3The rights of individuals
- 4Channels of receipt
- 5Registration and acknowledgement of receipt
- 6Identity verification
- 7Processing the request
- 8Time limits
- 9Costs
- 10Refusal, restriction or deferral
- 11Register and retention
- 12Training and review
An excerpt
1. Purpose and scope
This procedure sets out how __________ handles the requests by which a person exercises his or her data protection rights under the Federal Act on Data Protection (FADP) and the related Data Protection Ordinance and under the General Data Protection Regulation of the European Union (GDPR).
It applies to all employees and to all requests, whatever the channel through which they arrive and the form in which they are worded. A request is valid even if it does not cite the law and does not use our forms.
2. Roles
| Role | Tasks |
|---|---|
| All employees | Recognise a request and forward it immediately, without replying on their own initiative |
| __________, __________ (hereinafter "the internal coordinator") | Register the request, verify identity, coordinate the search for the data, decide on and sign the reply, keep the register |
| Heads of department and of IT | Search for and extract the data, carry out rectifications, erasures and blocks within the time limits indicated by the internal coordinator |
| Management | Decide in cases of refusal or dispute, designate a deputy for the internal coordinator |
The full text is generated on the platform, with your organisation's details already in place.
Related templates
- Personal data access request form template
- Request form template for erasure, rectification or objection
- Response templates for data subject requests
Related question: How to answer a request for access to personal data, and within what time?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.