WARNING - It is not legal advice — have counsel confirm the specific wording and workflow match your data practices.

Data Subject Rights Request Fulfillment Process¶

Document owner: [Privacy Officer name/title] Effective date: [Month DD, YYYY] Last reviewed: [Month DD, YYYY]

Note before using: This process operationalizes the individual rights guaranteed under Quebec’s Law 25 — access, rectification, erasure/de-identification (cessation of dissemination and de-indexing), restriction, withdrawal of consent, and data portability. Adapt timelines, roles, and systems to your organization, and have counsel review before adoption. Replace all bracketed placeholders.

1. Purpose and scope¶

This process defines how [Company Name] receives, verifies, and responds to requests from individuals (“Requestors”) exercising their rights under the Act respecting the protection of personal information in the private sector, regarding personal information we hold about them. It applies to all channels through which a request might arrive: email, contact form, phone, mail, or in person.

2. Roles and responsibilities¶

Role	Responsibility	Who
Privacy Officer	Owns the process, makes final decisions on contested/complex requests, maintains the request register	[Name/Title]
Intake team (support/legal/admin)	Logs incoming requests, performs initial triage	[Team/Name]
IT/Data team	Locates, extracts, corrects, or deletes data across systems	[Team/Name]
Legal counsel	Advises on refusals, exceptions, and any request involving litigation or regulatory risk	[Name/Firm]

Request intake channel: [privacy@yourcompany.com / web form link / mailing address] — published in our Privacy Policy.

3. The six rights and what fulfilling each one means¶

Right	What the individual can ask for	What we must do
Access	See what personal information we hold about them	Provide the information, its source, purposes, and (unless an exception applies) the categories of third parties it’s been shared with
Rectification	Correct inaccurate, incomplete, ambiguous, or unlawfully collected information	Correct it, and notify any third party who received the information in the preceding 6 months, unless disproportionate
Erasure / de-identification / cessation of dissemination	Have information deleted, de-identified, or, for published information, have it de-indexed or its dissemination stopped	Assess against the legal test in Section 6 below (this right has specific conditions — it isn’t automatic like the others)
Restriction of processing	Limit how their information is used pending resolution of a dispute (e.g., during a rectification review)	Pause the relevant processing while the underlying request is assessed
Withdrawal of consent	Stop processing based on consent (e.g., marketing)	Cease that specific processing going forward; does not affect processing already completed
Data portability	Receive their information in a structured, commonly used technological format, or have it transferred directly to another organization where technically feasible	Export in a usable format (e.g., CSV/JSON) or transmit directly if the receiving organization is identified and the transfer is technically feasible

4. Step-by-step process¶

Step 1 — Receive and log¶

Every request, regardless of channel, is logged in the Request Register (Section 8) within 1 business day of receipt, with a unique request ID, date received, channel, and stated right(s) being exercised.

Acknowledge receipt to the Requestor within [2 business days], confirming: - The request has been received and logged - The expected response timeline (Section 5) - Any identity verification needed (Step 2)

Step 2 — Verify identity¶

Before disclosing or acting on personal information, confirm the Requestor is who they claim to be, or is authorized to act on that person’s behalf (parent/guardian, legal representative, heir, mandatary).

Use a verification method proportionate to the sensitivity of the data involved — e.g., matching against information already on file (email/account login), a government ID for higher-sensitivity data, or a mandate/proof of authority for third-party requests.
Do not request more identifying information than necessary to verify identity — this is itself a data minimization obligation.
If identity cannot be verified, explain what’s needed and pause the clock until resolved.

Step 3 — Classify and route¶

Determine which right(s) are being exercised (a request may invoke more than one) and route to the appropriate handler:

Access / portability → IT/Data team compiles the information
Rectification → IT/Data team + source-of-truth system owner
Erasure / de-identification / de-indexing / cessation of dissemination → Privacy Officer + Legal (test in Section 6)
Restriction → Privacy Officer flags the record/system to pause relevant processing
Withdrawal of consent → System owner for the specific processing activity (e.g., marketing platform)

Step 4 — Search and compile¶

Identify all systems, databases, and (if applicable) paper records containing the individual’s personal information. Maintain a data inventory/map in advance (Section 9) so this step doesn’t require an ad hoc search each time.

Step 5 — Apply exceptions (if any)¶

Certain limited exceptions may justify withholding, redacting, or declining part of a request — for example, information that would reveal personal information about a third party, information protected by professional secrecy or legal privilege, or where disclosure could hinder a legal proceeding or investigation. Any exception applied must be: - Specific to the information withheld (not a blanket refusal) - Documented with reasoning - Reviewed by [Legal counsel] before the response is finalized

Step 6 — Respond¶

Respond to the Requestor within 30 days of receiving the request (or of successful identity verification, if that came later). The response must: - Address each right invoked - Provide the information/action taken, in clear and simple language - If refusing in whole or in part, state the specific reason and inform the Requestor of their right to seek review (Section 7) - If information is provided, use a format that is generally understandable — not raw database exports without explanation, unless portability format was specifically requested

If more time is needed: If the request is complex or high-volume, you may extend the deadline once by 30 additional days, but you must notify the Requestor before the initial 30-day deadline expires, with the reason for the extension.

No fee, generally — reasonable transcription costs may apply in limited circumstances, but must be disclosed to the Requestor in advance with an estimate before proceeding, and cannot be used as a barrier to the exercise of rights.

Step 7 — Close and log outcome¶

Record the outcome, response date, and any actions taken in the Request Register. Retain a copy of the request and response per your retention schedule (recommend at least [2-3 years]) in case of a later CAI complaint.

5. Response timeline summary¶

Milestone	Deadline
Acknowledge receipt	2 business days
Verify identity	As needed — clock pauses until resolved
Substantive response	30 days from receipt (or verified receipt)
Extension notice (if needed)	Must be sent before the original 30-day deadline expires; adds up to 30 more days

6. Special test for erasure / de-indexing / cessation of dissemination¶

Unlike access or rectification, this right is not automatic. Before granting a request to stop dissemination or de-index published personal information, assess:

Does the dissemination of the information cause serious injury to the individual’s reputation or privacy?
Is that injury clearly greater than:
the public’s interest in knowing the information, or
the interest tied to freedom of expression, or the recognized public interest of the information (e.g., a matter of public record, a public figure’s public conduct)?
If both conditions are met, is cessation of dissemination, de-indexing, or re-anonymization the appropriate remedy — chosen to be proportionate (least intrusive option that resolves the harm)?

Document this assessment in writing regardless of outcome — approvals and refusals both need a defensible paper trail.

For simple deletion requests not involving published/searchable content (e.g., “delete my account data”), this heightened test does not apply — assess instead against any legal retention obligations that might prevent full deletion (e.g., tax, accounting, or contractual record-keeping requirements), and de-identify or delete what isn’t legally required to be kept.

7. If the Requestor disagrees with our response¶

Inform every Requestor, in every response (including refusals), that they may:

Ask [Privacy Officer] to review the decision internally, and/or
File a complaint with the Commission d’accès à l’information du Québec (CAI) — www.cai.gouv.qc.ca

8. Request register¶

Maintain a log of every request (fulfilled, partially fulfilled, or refused):

Field	Description
Request ID	Sequential
Date received
Channel	Email/form/phone/mail
Right(s) invoked	Access/rectification/erasure/restriction/withdrawal/portability
Requestor identity verified?	Yes/No + method
Systems searched
Exceptions applied (if any)
Outcome	Fulfilled/partially fulfilled/refused
Response date
Extension used?	Yes/No + reason
Escalated to CAI?	Yes/No

9. Supporting infrastructure (build once, use every time)¶

To make this process fast and consistent rather than a scramble each time, maintain:

A data inventory/map: which systems hold which categories of personal information, and who owns each system
A standard identity verification procedure, tiered by data sensitivity
Response templates for each right and for common refusal scenarios, reviewed by legal
A designated intake channel that routes automatically to the Privacy Officer

10. Training¶

Customer-facing and support staff are trained to recognize a rights request even if not phrased using legal terms (e.g., “delete my info,” “stop emailing me,” “what do you have on me” all count) and to route it to [intake channel] immediately rather than attempting to resolve it themselves.
[Privacy Officer] reviews this process at least [annually] or after any CAI guidance update.

This process supports compliance with Quebec’s Act respecting the protection of personal information in the private sector (Law 25), including the individual rights provisions. It is not legal advice — have counsel review before adoption, particularly the exceptions in Section 5 and the erasure test in Section 6.