Data Subject Requests for Access

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    No process exists for individuals to access their data.

    Example Strategies

    • Communicate to personnel the importance of appropriately addressing a data subjects access request.
    • Inform personnel to bring any requests to the CAO to be addressed on an ad hoc basis while a process is developed.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    Individuals might informally inquire about their data, and responses are inconsistent or delayed.

    Example Strategies

    • Document a formal process for handling data subject access requests (DSARs).
    • Create a clear, written procedure for receiving, verifying, processing, and responding to GRAMA requests for personal data, including timelines.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    A basic process for GRAMA requests exists, but it might not clearly differentiate between general public records and personal data access requests, or responses may be slow.

    Example Strategies

    • Ensure consistent application of the DSAR process and provide dedicated resources.
    • Train all staff who might receive DSARs on the formal process, centralize intake (e.g., a dedicated email address or web form), and assign a specific team or individual responsible for coordinating responses to ensure consistency and compliance with GRAMA timelines.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    A formal, user-friendly, and consistently applied process for individuals to request access to their personal data is in place, ensuring timely and comprehensive responses in compliance with GRAMA.

    Example Strategies

    • Track DSAR metrics and identify areas for efficiency and improvement.
    • Implement a tracking system to record the number of DSARs received, their types, the time taken to respond, and outcomes, using this data to identify bottlenecks and streamline the process.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity tracks the volume, types, and resolution times of data access requests, analyzing trends to identify areas for process improvement or potential data quality issues.

    Example Strategies

    • Review of all data subject requests for access can be measured over time to indicate where and whether there needs to be additional resources for continued improvement of the practice.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    An online portal or automated system allows individuals to easily submit, track, and receive responses to their data access requests, enhancing transparency and efficiency.