This procedure is intended to be used when a data subject exercises one or more of the rights, they are granted under the European Union General Data Protection Regulation (GDPR). Each of the rights involved has its own specific aspects and challenges to DigitalXC in complying with them and doing so within the required timescales. In general, a proactive approach will be taken that places as much control over personal data in the hands of the data subject as possible, with a minimum amount of intervention or involvement required on the part of DigitalXC. This may be achieved by providing online access to the personal data so that the data subject can verify and amend it as required. However, in some cases there is a decision-making process to be followed by DigitalXC regarding whether a request will be allowed or not; where this is the case, the steps involved in these decisions are explained in this document.
