Data Subject Rights (DSR)

Data Subject Requests (DSRs) are formal requests from individuals exercising their rights under data protection laws. The Compliance module provides a complete, structured DSR workflow: submission, assignment, review, processing, and closure — with a full append-only audit trail and SLA tracking.

Request Types

The system supports five DSR types as defined by GDPR and CCPA regulations:

Request Lifecycle

DSR tickets are modeled as state transitions with a review cycle and safety confirmation gates to prevent accidental and irreversible deletions:

DSR Anonymization Execution Flow

Erasure request execution anonymizes personal data asynchronously across modules via fanned-out provider implementations:

SLA Tracking & Deadline Calculations

Compliance regulations dictate strict response timelines. SCRIPE automatically calculates and tracks SLA metrics on the admin dashboard:

Escalation Engine & Alerts

The DsrEscalationJob runs daily at 08:00 UTC to evaluate SLA consumption and escalate overdue tickets:

Extensible Provider Architecture

To maintain loose coupling, the Compliance module communicates with other modules using the IUserDataProvider and IUserDataAnonymizer abstractions:

Entity Reference

The core DSR domain aggregate stores request metadata, current status, verified subject identifiers, and execution timestamps.

CQRS Handlers & Domain Events

DSR processing leverages CQRS commands and queries, emitting domain events across module boundaries to invoke registered data anonymizers.

public class SubmitDsrCommandHandler : ICommandHandler<SubmitDsrCommand, Guid>
{
    public async Task<Result<Guid>> Handle(SubmitDsrCommand request, CancellationToken ct)
    {
        // 1. Calculate SLA deadline based on regulation profile
        var regulation = await _regulationRepo.GetByCodeAsync(request.RegulationCode, ct);
        var deadline = DateTime.UtcNow.AddDays(regulation.ResponseSlaDays);
        
        // 2. Create the entity
        var dsr = new DataSubjectRequest
        {
            TenantId = _tenantContext.TenantId,
            SubjectEmail = request.SubjectEmail,
            RequestType = request.RequestType,
            RegulationCode = request.RegulationCode,
            Status = DsrStatus.Pending,
            Deadline = deadline
        };
        
        await _repository.AddAsync(dsr, ct);
        await _unitOfWork.SaveChangesAsync(ct);
        
        // 3. Domain event triggers webhook
        dsr.AddDomainEvent(new DsrSubmittedEvent(dsr.Id));
        
        return Result<Guid>.Success(dsr.Id);
    }
}

API Endpoints

Quick Start Guide

1. 1

   Seed Compliance Profiles

   Run the development seeder to populate GDPR and CCPA regulation profiles with SLA days.
2. 2

   Submit a Data Subject Request

   Use the POST endpoint to log a new request. The system validates input constraints and calculates the response deadline.
   JSON

   Copy

   POST /api/v1/compliance/dsr
   {
     "requestType": "Export",
     "regulationCode": "GDPR",
     "subjectEmail": "user@example.com"
   }

3. 3

   Review and Approve

   The assigned compliance officer reviews the ticket. Approving an Erasure DSR sets the grace period and awaits final nuclear confirmation.