From intake to response letter — one workflow, one clock.

A missed DSR is a regulator's first exhibit.

Under DPDP, the grievance officer is a named accountability. A missed clock, a partial response or an unverified requester each surface the programme's operational weakness.

DPDP §§11–14 grants access, correction, erasure and grievance rights — with the Data Fiduciary required to respond in the time prescribed by rule.

DSRs cross every team and every system.

A single request may touch CRM, product, support, marketing and vendors. The identity of the requester must be verified. The response must cite what was done — not just that it was done.

• Grievance intake per legal entity with named grievance officer.
• Identity verification with attempt log.
• Task fan-out across systems from the enterprise inventory.
• Response letter generated with lineage — what was returned, corrected, erased.
• SLA clock per request with escalation paths.

One intake. One clock. One response.

Every request runs the same lifecycle. No off-platform email chains.

1. 01
   Intake

   Public form per legal entity captures request type and identity claims.
2. 02
   Verify

   Identity check against the record — attempts logged.
3. 03
   Scope

   Fan-out tasks to systems and vendors that hold the requester's data.
4. 04
   Fulfil

   Named owner per task returns, corrects or erases with evidence.
5. 05
   Respond

   Response letter generated citing what was done per system.
6. 06
   Close

   Closure record with SLA compliance and audit trail.

A closed request with lineage.

The response letter references specific systems and specific actions — not a paragraph of assurance.

Rights honoured on time, with a record.

The response is not a paragraph — it is a lineage. The regulator sees what was done, where, by whom.

Grounded in

DPDP §§11–14

SLA

Per request type

Response

System-level lineage