Open the request. It is assigned to the grievance officer named in your settings. Use Assign to give it to someone else who can handle privacy requests. Move it forward with Move to. The steps are Submitted, Acknowledged, In progress, Waiting for the requester, Completed, Rejected. Each step that the person sees needs a Message to the requester. Completing without a message is refused. Use Add a note for notes only your team reads. They are not shown to the requester. The timeline marks each line as seen by the requester or internal. For a "See my data" request press Prepare a copy of the data. When it is ready press Download. It is a ZIP with a manifest and the data as CSV and JSON files. The requester also gets A copy of your data is ready in My privacy or the phone app, and the copy expires after some days. For an erase request, the Erase data panel lists only four categories (for example the student's photo and health notes) and says what is kept by law. Choose and confirm. This cannot be undone.

DPDP: data requests, grievances and breaches

Requests and grievances

Open Privacy > Requests and grievances. A parent, student or staff member can ask from My privacy, or the office can record one for a person who comes in or writes.

Kinds: See my data, Correct my data, Erase my data, Complaint, Nominate someone. Each gets a number, a status and a due date, 30 days ahead by default. The list shows overdue ones in red.

Handle a request

Open the request. It is assigned to the grievance officer named in your settings. Use Assign to give it to someone else who can handle privacy requests.
Move it forward with Move to. The steps are Submitted, Acknowledged, In progress, Waiting for the requester, Completed, Rejected. Each step that the person sees needs a Message to the requester. Completing without a message is refused.
Use Add a note for notes only your team reads. They are not shown to the requester. The timeline marks each line as seen by the requester or internal.
For a "See my data" request press Prepare a copy of the data. When it is ready press Download. It is a ZIP with a manifest and the data as CSV and JSON files. The requester also gets A copy of your data is ready in My privacy or the phone app, and the copy expires after some days.
For an erase request, the Erase data panel lists only four categories (for example the student's photo and health notes) and says what is kept by law. Choose and confirm. This cannot be undone.

Who can do this

The principal, the institution admin and the grievance officer. A teacher cannot be named the grievance officer.

Data breaches

A breach is when personal data is seen, lost or changed by someone who should not. Open Privacy > Data breaches and press the button to record one.

Describe what happened and when it was found. The list shows how many hours are left to report to the Data Protection Board (72 by default).
In the breach, fill the assessment: what data, how many people, what it may mean, and what they can do. The three texts for people, the Board and your records fill as you save.
Press Tell the people affected. It is refused until "what it may mean" and "what they can do" are filled. Then the notice is queued.
Record the first intimation to the Board and then the detailed report.
Close the breach when done.

The dashboard shows "Board report late" and "People not told in time" if a deadline is missed.

Common questions

The due date says overdue.

Complete or answer the request now and write why it was late in a note.

Can I erase a student's whole record?

No. Only the listed categories can be erased. Records the law requires you to keep are kept.

Using SunRuby already? Press the ? button at the top of any screen for the guide to that screen.