The life of a privacy request

Every request has a reference (like DSAR-7K2M9QX4), a status, and a deadline. Here's what each status means and what moves the request along.

Statuses

Status	What it means	What moves it on
Received	Submitted, but the requester hasn't clicked their verification link yet.	The requester verifies their email (they have 7 days).
Verifying	Email verified, but identity or authority still needs your confirmation.	You confirm identity on the detail page.
In progress	Verified and being worked. Collection tasks are live.	Tasks complete; you package the response.
Ready	Packaged and awaiting sign-off or delivery.	DPO sign-off, then delivery.
Closed	Delivered and finished, or withdrawn.	Nothing. Retention rules take over.
Rejected	Refused, with the reason recorded and sent.	The requester may appeal.

The deadline

The clock starts at verification, not submission. The deadline is set automatically from where the requester lives:

• UK and EU requests: your default SLA from Settings, 30 days out of the box.
• US (California) requests: 45 calendar days, as CCPA/CPRA requires.

A workflow template with a shorter internal SLA can tighten the due date further. It never extends the legal deadline.

Staying ahead of the deadline

You don't need to watch the queue all day:

• Requests coming due are flagged in escalating tiers: due within 7 days, due within 3 days, and overdue.
• The daily digest email gives DPOs the morning picture: new requests, what's overdue, what's due in the next 3 days, open appeals, packages awaiting sign-off, and unread messages.
• Task owners are nudged automatically when their task is due soon or overdue.

Assignment

Any analyst or DPO can assign a request to a team member from the detail page. Unassigned requests are everyone's problem, so assign early.