Dekimu · anchored receipts docs

ASR — Anchored Subject-Rights Receipts

Cryptographic proof of a data-subject rights request lifecycle — from receipt through fulfilment, refusal, or escalation.

← All families

Purpose

An ASR anchors each stage of a data-subject rights request: when the request was received, when identity was verified, whether the deadline was extended, and how the request was ultimately resolved. The receipt chain provides a tamper-evident audit trail for regulators and data subjects alike.

The request.recipient_notified event documents notification to third parties (processors, joint controllers, recipients) following an erasure or rectification, as required by Art. 19.

Event types

KindLabelDescription
request.receivedReceivedRequest logged.
request.identity_verifiedIdentity verifiedRequestor authenticated.
request.scope_clarifiedScope clarifiedRequest scope narrowed.
request.extendedExtendedResponse deadline extended.
request.partially_honouredPartially honouredPartial fulfilment.
request.fulfilledFulfilledRequest fully completed.
request.refusedRefusedRequest denied with justification.
request.escalatedEscalatedReferred to supervisory authority.
request.recipient_notifiedRecipient notifiedThird parties informed.

Key fields

right_type — which GDPR right is being exercised: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), or automated-decision opt-out (Art. 22).

response_deadline — ISO 8601 datetime by which the controller must respond. Defaults to 30 days from receipt unless extended.

extension_reason — justification for any deadline extension (Art. 12(3) allows up to two further months for complex or numerous requests).

Regulatory context

ASR receipts span GDPR Arts. 15–22 (the full suite of data-subject rights) and Art. 12(3), which sets the one-month response deadline and conditions for extension. A refused request must document the legal basis for refusal and inform the subject of their right to lodge a complaint with a supervisory authority; the request.refused event captures both. Escalation receipts document when a data subject has exercised the right to complain directly.

Anchored Receipts are cryptographic provenance and privacy-lifecycle protocols; verify.dekimu.com is a reference implementation, not a qualified trust service under Regulation (EU) No 910/2014 (eIDAS) or successor.