Privacy requests
Data subject requests (access, erasure...) with the exact legal due date, identity checks, a handler and reminders.
Records: privacy requests
Privacy work, deadlines included.
Requests from individuals with their legal due date, breaches with the 72-hour deadline worked out, a record of processing that finds its own gaps, and retention that deletes only after a yes.
Sample conversation
You
A former customer, Mia Fournier, emailed today asking for all the data we hold on her. Lena Hoffmann handles it.
Kibo
I will log an access request received 7 November. The due date is one calendar month, 7 December 2026, and her identity must be verified first, with no more data than needed.
Access request, Mia Fournier
PersonMia Fournier, by emailTypeaccessReceived7 Nov 2026Identity verifiednoStatusverifying identity
1 · What it runs
The processes in this kit.
Ready-made privacy processes for the privacy group and the data protection officer: data subject requests with the exact legal due date (one calendar month, extension rule built in), personal data breaches with the 72-hour authority deadline computed exactly, the record of processing with its gaps found automatically, and retention reminders that propose deletion - nothing is ever deleted without a yes. The tables are for the privacy group only; data subjects never get access.
Data breach response
Personal data breaches with the 72-hour authority deadline computed exactly, the risk, the decision and who was told.
Records: breaches
Records of processing
The record of processing (GDPR article 30): purposes, legal bases, data, processors, transfers, retention - gaps found automatically.
Records: processing activities
Data retention
How long each kind of record is kept; records past retention are proposed for deletion - never deleted without a yes.
Records: retention schedule, deletion log
2 · Examples
Real requests, and the card each one produces.
Sample conversation
You
A former customer, Mia Fournier, emailed today asking for all the data we hold on her. Lena Hoffmann handles it.
Kibo
I will log an access request received 7 November. The due date is one calendar month, 7 December 2026, and her identity must be verified first, with no more data than needed.
Access request, Mia Fournier
PersonMia Fournier, by emailTypeaccessReceived7 Nov 2026Identity verifiednoStatusverifying identity
Sample conversation
You
Jonas Weber asked us to delete his data. His identity is confirmed. We received it on 31 October.
Kibo
Received 31 October, it is due 30 November, the last day of that month. I will log the erasure request; deleting anything needs your separate yes later, and invoices we must keep for tax stay.
Erasure request, Jonas Weber
TypeerasureReceived31 Oct 2026Identity verifiedyesHandlerLena HoffmannStatusin progress
Sample conversation
You
Report a breach: Nina sent the payroll file to the wrong colleague by email on Thursday at 14:30. About 40 employees.
Kibo
I will record the breach from awareness on Thursday 5 November at 14:30. The authority deadline is then Sunday 8 November at 14:30, 72 hours later. The privacy group is told at once.
Payroll file sent to the wrong colleague
Detected at5 Nov 2026, 14:30Data affectedNames, salaries and bank details of employeesPeople affected40ContainednoStatusreported
Sample conversation
You
Record the decision for the payroll breach: risk to people, so we notify the authority. Lena Hoffmann decides.
Kibo
I will record the decision with Lena Hoffmann as decider. It counts once she confirms it, and the notification is due before Sunday 8 November at 14:30.
Decision on the payroll breach
ContainedyesRisk to peopleriskDecisionNotify the authority: salary and bank data of 40 people were seen by one unauthorised colleagueDecided byLena HoffmannDecision approvedwaiting
Sample conversation
You
Add payroll to our record of processing. Legal obligation, data is kept 10 years, Lena Hoffmann owns it.
Kibo
I will add the activity as a GDPR Article 30 entry and check it for gaps, such as a missing processor agreement or retention period.
Payroll
ActivityPayrollPurposePay employees and meet tax and social security dutiesLegal basislegal obligationSpecial categoriesnoRetention10 years
Sample conversation
You
We start using a US recruiting platform in January. Record it before we go live. Data stays with the standard contractual clauses.
Kibo
I will add the activity with a transfer outside the EEA and the standard contractual clauses. Whether a DPIA is needed stays open to check, and the platform must be in the supplier register with a data processing agreement.
Recruitment platform
ActivityRecruitmentData subjectsCandidatesTransfers outside EEAyesTransfer safeguardstandard contractual clausesDPIA neededto check
Sample conversation
You
Keep rejected candidates for 6 months after we close the application, then they should be flagged for deletion. Lena Hoffmann owns the rule.
Kibo
I will add the rule to the retention schedule. Records past their period are listed every month with a proposal, and nothing is deleted without your yes.
Rejected candidates, 6 months
RuleCandidates not hiredKeep for months6Counted fromclosed onOnly with statusrejectedLegal reasonrejected
Sample conversation
You
Pause the rule for support tickets. There is a dispute going on and legal says nothing may be deleted for now.
Kibo
I will set the support tickets rule to paused and note the legal hold as its reason, so nothing is proposed for deletion from it.
Support tickets: legal hold
RuleClosed support ticketsKeep for months24Legal reasonLegal hold: ongoing dispute, no deletion until legal lifts itStatuspaused
3 · Approvals and reminders
Rules it sets up, enforced by code.
- Reminder · privacy requests: 7 days before “due”
- Reminder · privacy requests: 1 days after “due”
- Approval · Breach decisions
Step 1: the person named in “decided by” when “decision” is filled in - Reminder · breaches: 1 days before “authority deadline”
- Reminder · breaches: On the day of “authority deadline”
- Reminder · processing activities: 30 days before “next review”
- Report · A summary to the manager, the 1st of each month at 9:00