Under Chapter III of the European Union General Data Protection Regulation (GDPR), website visitors and consumers have clear legal rights to control their personal data. These requests are commonly referred to as Data Subject Requests (DSR).
QookieQloud™ provides a fully integrated, automated workflow directly inside the consent banner, making it seamless for visitors to exercise their privacy rights and effortless for website owners to maintain compliance without manual overhead.
The Three Core GDPR Rights
Article 15: Right of Access (Data Export)
Visitors are entitled to obtain confirmation and an exported summary of all stored consent parameters, including timestamps, unique consent IDs, and granted cookie categories.
Read Article 15 (GDPR) ↗Article 16: Right to Rectification
Visitors have the right to obtain without undue delay the rectification of inaccurate or incomplete personal data held within your connected databases or CRM systems.
Read Article 16 (GDPR) ↗Article 17: Right to Erasure ("Right to be Forgotten")
Visitors can demand the permanent and irreversible erasure of their personal data and registered consent records across all processing channels.
Read Article 17 (GDPR) ↗How the DSR Workflow Operates in QookieQloud™
Visitor Submits Request via Banner
From the Privacy Rights tab in the active consent dialog, visitors select their desired request type (Erasure, Access, or Rectification) and enter their email address. An automated receipt is immediately emailed to the visitor.
Real-Time Alerts & Sidebar Warning Badges
You receive an instant notification email. In the QookieQloud admin dashboard, the Consents navigation item highlights a warning badge displaying the number of pending DSR requests for the active domain.
Contextual Resolution & Visitor Response
Under Domains > Consents, clicking Resolve DSR provides contextual handling tailored to the specific legal article:
- Access Requests (Art. 15): The completion email can include a summary of the consent information available in QookieQloud. The website owner must separately locate data held in other systems.
- Rectification Requests (Art. 16): You can verify connected customer data and include an optional custom confirmation note in the resolution modal.
- Erasure Requests (Art. 17): You handle deletion in your own systems. QookieQloud sets the linked consent record to necessary-only categories and replaces its stored IP address and user-agent value.
Zero retention of personal data after case closure
When a case is completed, personal data collected for the DSR request—including contact details, verification values, and free-text details—is deleted, and the link to the visitor's consent record is severed. To provide a handling record, a limited log containing the case reference, domain, request type, and dates is kept for 12 months. It contains no contact details, verification values, case details, or consent ID, and is then deleted automatically.
Enabling or Disabling the DSR Tab in the Banner (Premium)
For all domains on a Premium plan, the DSR tab (Privacy Rights) is enabled by default. If your organization prefers to handle data subject requests through a separate channel (such as an external corporate portal or a designated DPO email address), you can easily toggle the tab off:
1. Navigate to Domains in your admin dashboard and select your domain.
2. Click Settings in the side navigation and open the Privacy requests tab.
3. Locate the Privacy requests card and toggle the switch off.
4. Click Save. The setting is encrypted and immediately propagated to visitor banners.
Want to provide visitors with a direct shortcut to the DSR form? Add the CSS class class="qookieqloud-dsr-panel" to any link or button (such as in your footer or privacy policy) to open the banner directly with the DSR tab active.
Frequently Asked Questions about DSR & Privacy Rights
Can I disable the DSR tab if I use an external DPO portal?
Yes. As a Premium customer, you can disable the DSR tab at any time under Settings → Privacy requests in the admin dashboard. Once toggled off, the "Privacy Rights" tab is completely hidden from your public consent banner.
How does zero retention apply to personal data in completed DSR cases?
Personal data collected for the request—including contact details, verification values, and free-text details—is deleted when you complete a case, and the link to the consent record is severed. A limited log containing the case reference, domain, request type, and dates is kept for 12 months to record that the case was handled. It contains no contact details, verification values, case details, or consent ID, and is then deleted automatically.
How does Article 15 Data Access / Export work?
The completion email can include a summary of the consent information QookieQloud holds for that record. The website owner must also locate and provide any personal data held in their other systems.
How do I handle Rectification requests (Article 16)?
You update the visitor's records within your internal database or CRM, and you can provide an optional explanatory message in the resolution modal before closing the request.
What happens when an Erasure request (Article 17) is resolved?
QookieQloud then sets the linked consent record to necessary-only categories and replaces its stored IP address and user-agent value. This does not affect data in your other systems, which you must handle separately.
View all questions in the FAQ Hub →
Official Regulatory References
For in-depth legal requirements and controller responsibilities, consult the official European Union documentation:
Explore your active domain settings and handle pending GDPR requests directly from the QookieQloud admin interface.
