Handle access requests and data subject rights on time
When someone asks what data you hold about them, the Swiss Federal Act on Data Protection (FADP) sets a deadline of 30 days, the European General Data Protection Regulation (GDPR) one month. Aiara receives access requests and other requests through a form in four languages, calculates the deadline and reminds your team before it expires.
Data subject requests in Pro, from CHF 240 per year and domain, with consent statistics and PDF reports.
- 30 days to respond from receipt
- 4 languages in the form
- 3 channels for requests
- 4 statuses per request
What is an access request?
With an access request, a person asks whether and which personal data a company processes about them. The right of access is set out in Art. 25 of the Swiss Federal Act on Data Protection, and the answer is generally due within 30 days, under the GDPR within one month. Aiara collects these requests in one place and tracks the deadline.
The legal basis
The right of access is set out in Art. 25 FADP. Under Art. 18 of the Swiss Data Protection Ordinance, the information must be provided within 30 days. If that is not possible, tell the person by when they will receive it. The information is generally free of charge. For people in the EU, Art. 15 GDPR applies, and the answer is due within one month under Art. 12 GDPR.
How a request moves through Aiara
- 1
A request comes in
Through the form on your website, entered by hand, for example after a letter or phone call, or through the API. Every request gets a date of receipt.
- 2
Your team is notified
Your team receives an email. Aiara calculates the 30-day deadline from receipt and shows the due date on the request.
- 3
Process
Check the person's identity, gather the data and set the status to “in progress”. You send the answer to the person yourself.
- 4
Close
Once the request is answered, set it to “completed” or “rejected”. Until then Aiara reminds you 7 days and 1 day before the deadline, then daily.
Steps and deadlines of a request
The deadline starts on receipt. This is how Aiara accompanies a request until it is closed.
Day 0
Receipt
The request lands in the list, and your team receives an email. The 30-day deadline begins.
Day 23
Reminder
Seven days before the deadline, Aiara reminds your team by email.
Day 29
Reminder the day before
One day before the deadline, the next email follows.
Day 30
Deadline
By now the answer should have reached the person. If that is exceptionally not possible, tell them by when they will receive the information.
from day 31
Daily
If the request is still open, Aiara sends a reminder every day.
What request management offers
Form in four languages
German, French, Italian and English. Link it from your privacy policy or from any other page.
Deadline calculated automatically
30 days from receipt. Aiara shows the due date on every request so nothing slips.
Reminders before the deadline
Emails to your team 7 days and 1 day before the deadline, then daily while the request is open.
All channels in one place
Requests from the form, letters, emails or calls entered by hand and requests via the API end up in the same list.
A clear status
Open, in progress, completed or rejected. Your team sees at a glance what is pending.
Linked to your privacy policy
A switch places the link to the form directly in the privacy policy you create with Aiara.
Requests covered by the form
In the form, the person chooses what the request is about.
- Access
- Whether and which personal data you process about the person, for what purpose and where it comes from.
- Rectification
- Correct inaccurate personal data.
- Erasure
- Delete personal data you may no longer process or no longer need.
- Data portability
- Receive one's own data in a common electronic format or have it transferred.
- Objection
- Object to a specific processing, for example for advertising.
Frequently asked questions
What is an access request under the FADP?
A request through which a person learns whether and which personal data you process about them. Under Art. 25 FADP, the information includes, among other things, the data itself, the purpose of processing, the retention period, the origin of the data and, where applicable, the recipients.
How long do I have to answer an access request?
In Switzerland, 30 days from receipt (Art. 18 of the Data Protection Ordinance). If the deadline cannot be met, inform the person and state the period within which the information will follow. Under the GDPR, one month applies. Aiara calculates the 30-day deadline and reminds your team before it expires.
Which data subject rights exist besides access?
The FADP provides, among others, the right to have inaccurate data corrected, to have data erased, to receive or transfer one's own data and to object to processing. The GDPR provides comparable rights. In Aiara's form, the person chooses which right they are exercising.
How do requests reach Aiara?
Through the public form in four languages that you link on your website. You enter letters, emails or calls by hand, and an API lets you submit requests from your own systems.
Does the requesting person receive an automatic confirmation?
No. Aiara notifies your team by email of every new request. You send the acknowledgement and the answer to the person yourself, so communication stays in your hands.
What happens as the deadline approaches?
Aiara sends your team an email reminder 7 days and 1 day before the deadline. If the request is still open after that, another one follows every day.
How do I link the form in my privacy policy?
If you create your privacy policy with Aiara, a switch is all it takes and the link to the form appears in the text. For other pages, copy the link to the form from the dashboard.
How much does data subject request management cost?
It is part of Pro, together with consent statistics, PDF reports and the privacy policy under the GDPR. Pro costs CHF 240 per year and domain, excluding VAT.
Never miss a deadline again
Data subject requests in Pro, from CHF 240 per year and domain, with consent statistics and PDF reports.