Recognize a possible privacy request
Listen for a request about a person's own information or how it is used.
Access or copy
The person asks what personal information is held about them or requests a copy.
Correction or deletion
The person asks to correct information or have information removed.
Use or sharing
The person asks to limit, stop, or object to the use or sharing of personal information.
Not clearly a privacy request
A routine HR question with no request about personal data belongs with the appropriate HR route. If unsure, ask the privacy specialist to triage.
Route it; do not adjudicate it
Use the approved local process for verification and submission.
-
1
Acknowledge without promising
Thank the person for raising the matter. Do not promise that a request qualifies, predict a result, or give a deadline.
-
2
Use the approved verification route
Direct the person to the organization’s approved identity-verification channel. Do not collect identity documents or verify identity yourself.
-
3
Keep a minimal routing note
Record only what the approved handoff process requires, such as the received date, the person’s preferred reply route, and the type of help they asked for. Do not copy or forward a full record set.
-
4
Send it to the authorized specialist
Use the approved internal privacy handoff process. If the right route is unclear, contact the privacy specialist for direction rather than sending personal information to a broad group.
Worked example: a forwarded email
A customer writes to a Northstar Works account manager: “Please send me the personal information your team has about me.” The account manager acknowledges the message without assessing the request, directs the person to the approved verification channel, and sends the privacy specialist a minimal routing note: received date, preferred reply route, and “request for a copy of personal information.” The account manager does not attach the customer’s account history or decide what must be disclosed.
Why this is the safer handoff: the specialist receives enough context to triage while identity verification, applicable requirements, and the response remain with authorized roles under the approved process.
