Data Subject Rights and Consent Management
Rights requests are a workflow with clocks
Candidates must understand the lifecycle of a data subject request: intake through any channel, identity verification proportionate to sensitivity, logging, search across systems including backups and processors, response within the statutory deadline, and records of the outcome. Common rights include access, correction, deletion, restriction, objection, portability, and withdrawal of consent. The auditor tests timeliness, completeness of the search, accuracy of the response, and the audit trail.
Consent management is a separate control set. Valid consent generally requires that it be freely given, specific, informed, unambiguous, and revocable as easily as it was given. Auditors examine the consent capture mechanism, the records retained (who, when, what wording, which version), granularity of purposes, separation of consent from other terms, and the propagation of withdrawal to downstream systems and vendors.
Traps abound. A frequent one is treating a request log as proof of completion without sampling the actual responses. Another is accepting "we searched the CRM" when the request scope also covers email archives and a marketing vendor. Pre-ticked boxes, bundled consent, and consent walls are classic indicators of invalid consent. Also watch for withdrawal that stops new marketing but leaves the person in an existing suppression-gap or in a vendor's list.
Worked example. Of 30 sampled access requests, 27 were answered within the deadline. The three late ones involved requests routed to a regional team with no tracker. The finding should address the routing gap and the absence of a global clock, not individual tardiness.
Rule of thumb: test the whole chain, from receipt to verified delivery, and confirm the same request cannot be closed without a response artifact.