Rights requests and SLAs

People can ask to see, correct, update or delete their data, nominate someone, withdraw everything, or complain. OptProof gives them a portal to ask, and gives your team a request desk with due dates, reminders and a full timeline.

Product defaults, not legal advice

The time limits and retention periods on this page are OptProof's product defaults. Values marked as needing counsel review are being confirmed with data-protection counsel and may change. Check them against the law that applies to your business, and change the defaults in your workspace settings where you need to.

How a request arrives#

The person opens your rights portal at my.optproof.in/<your workspace> (or your own domain on white-label plans) and picks a request type.
They confirm who they are with a one-time code sent by email. No password is ever involved. (Codes by text message will come later.)
They describe what they want and submit. They get a reference number and a confirmation by email.
The request lands in your Request desk with its due date already set.

Your team can also add requests received by phone, email or at the counter, so every request is tracked in one place.

Request types and default time limits#

Type	What the person is asking for	Default time limit
See my data (`access`)	Get a summary of the personal data we hold about you, what we use it for, and who we share it with.	30 days (product default)
Correct my data (`correction`)	Ask us to fix personal data about you that is wrong or misleading.	30 days (product default)
Complete or update my data (`update`)	Ask us to add missing details or bring your personal data up to date.	30 days (product default)
Delete my data (`erasure`)	Ask us to delete your personal data. Some records may have to be kept for a time because the law requires it. If so, we will tell you which ones and why.	30 days (product default)
Raise a complaint (`grievance`)	Tell us about a problem with how we handled your personal data or one of your requests. If you are not happy with our answer, you can then complain to the Data Protection Board of India.	90 days (upper limit, cannot be set longer)
Nominate someone (`nomination`)	Choose a person who can use your data rights on your behalf if you die or become unable to act yourself.	30 days (product default)
Withdraw all consent (`withdraw_all`)	Stop all processing that is based on your consent. Your earlier consent records stay as proof of what you agreed to and when.	7 days (product default)

The due date is the end of the day, India time, that many days after the request was created. Grievances can never be set longer than 90 days, even if you change the default.

Note

Withdrawing consent does not need a request. The preference centre and the widget's Privacy choices link take effect immediately, in no more steps than it took to agree. The Withdraw all consent request type is there for people who prefer to ask.

SLA timers and reminders#

Each open request shows a timer that turns amber at 80% of the time limit and red when overdue. Your team is reminded at 50%, 80%, 100% of the time limit. If several points pass at once, only the latest reminder is sent.

Reminders also fire the request.due_soon webhook, so you can route them into your own ticketing tool.

Statuses#

Status	Meaning
`new`	Just submitted.
`verifying`	Waiting for the person to confirm their one-time code.
`open`	Verified and with your team.
`waiting_tenant`	Waiting on someone inside your organisation, such as the owner of a system.
`resolved`	Done, with a resolution sent to the person.
`rejected`	Closed without action, with a reason sent to the person.

Resolved and rejected requests are final. If the person is not satisfied, they can raise a grievance, which starts a new request. Every step (status changes, notes, replies, system outcomes) is kept on the request's timeline.

Access requests#

For See my data, OptProof builds a summary automatically: the purposes the person consented to, the data items each purpose uses, and the processors involved, from your purposes and vendor register. Your DPO adds anything held in systems OptProof does not see, reviews it, and sends it.

Erasure requests#

When you approve an erasure request:

the erasure.requested webhook fires, and every connected tool that can erase does so, with each result added to the timeline;
systems OptProof cannot reach appear on a checklist in the request, for your team to complete and note;
records the law requires you to keep are marked with a retention exception and a reason, instead of being deleted. The person is told which records are kept, why, and that they will be deleted when the period ends.

The consent ledger itself is never edited. It holds only pseudonymous references, not contact details, so erasure happens in the systems that hold the data, and the request timeline records what was done where.

Retention exceptions#

These are the reasons your team can choose when records must be kept. Periods are minimums to check against the rules that apply to you.

Exception	What the person is told	Default minimum
Medical records	Doctors and clinics must keep treatment records for a minimum period. We will keep your medical records for that period and delete them afterwards.	3 years
Medico-legal case records	Records linked to a medico-legal case must be kept until the case is closed. We will delete them after that.	Until the condition ends
Prescription and dispensing records	Pharmacies must keep records of medicines they supply for a minimum period.	2 years
Insurance claim records	Records sent to your insurer or TPA for a claim must be kept while the claim and any review of it are open.	8 years
Invoices and accounts	We must keep invoices and payment records for tax purposes. We keep only what the bill needs.	8 years
KYC records	Financial services must keep identity (KYC) records for a period after your account closes.	5 years
Academic records	Schools and colleges keep marks, certificates and admission records so they can verify them later.	Until the condition ends
Consent records	We keep a record of what you agreed to and when, even after you withdraw, so we can prove we respected your choice. It holds no contact details.	7 years
Security and processing logs	We keep security logs for a minimum period to detect and investigate misuse of data.	1 year
Open dispute or legal claim	Some records must be kept while a dispute, complaint or legal claim is open.	Until the condition ends

All of these entries are drafts pending counsel review.

Working with requests from your backend#

Every request is also available through the server API: list and filter requests, read the timeline, change status or assignee, and add notes or system outcomes. See Server API.

bash

curl "https://api.optproof.in/v1/requests?status=open&type=erasure" \  -H "Authorization: Bearer sk_live_..."

To record that one of your systems has deleted the data:

bash

curl https://api.optproof.in/v1/requests/req_.../events \  -H "Authorization: Bearer sk_live_..." \  -H "Content-Type: application/json" \  -d '{ "action": "system_done", "system": "Clinic EMR", "note": "Patient record anonymised" }'

Use system_unreachable when a system cannot be updated, and retention_exception with a reason when records must be kept.