Residence, jurisdiction, and which law applies

The intake form asks every requester where they live: UK, EU, US, or somewhere else. That answer drives which legal regime the request is handled under, and therefore its deadline.

What each answer does

• UK: handled under UK GDPR. Deadline is your default SLA (30 days out of the box). The regional UK privacy notice is linked on the form.
• EU: handled under EU GDPR, same deadline behaviour, EU notice linked.
• US: handled under CCPA/CPRA with a 45 calendar day deadline, US notice linked.
• Somewhere else: the request is accepted, but no regime is assumed.

The unconfirmed-regime warning

Requests from "somewhere else" show a warning on the detail page until a member of your team confirms which regime to apply. Pick the closest applicable one and the request gets the matching deadline. The confirmation, who made it and when, is recorded.

Don't leave the warning sitting: an unconfirmed request still ages, and you don't want to discover late that a 30 day clock applied.

When the answer looks wrong

Residence is self-declared. If someone selects US but everything about the account says Manchester, use the message thread to check, then set the jurisdiction on the detail page. The safest default when genuinely unsure is the stricter deadline.