Dekimu · anchored receipts docs
ASR — Anchored Subject-Rights Receipts
Cryptographic proof of a data-subject rights request lifecycle — from receipt through fulfilment, refusal, or escalation.
Purpose
An ASR anchors each stage of a data-subject rights request: when the request was received, when identity was verified, whether the deadline was extended, and how the request was ultimately resolved. The receipt chain provides a tamper-evident audit trail for regulators and data subjects alike.
The request.recipient_notified event documents notification to third parties (processors, joint controllers, recipients) following an erasure or rectification, as required by Art. 19.
Event types
| Kind | Label | Description |
|---|---|---|
request.received | Received | Request logged. |
request.identity_verified | Identity verified | Requestor authenticated. |
request.scope_clarified | Scope clarified | Request scope narrowed. |
request.extended | Extended | Response deadline extended. |
request.partially_honoured | Partially honoured | Partial fulfilment. |
request.fulfilled | Fulfilled | Request fully completed. |
request.refused | Refused | Request denied with justification. |
request.escalated | Escalated | Referred to supervisory authority. |
request.recipient_notified | Recipient notified | Third parties informed. |
Key fields
right_type — which GDPR right is being exercised: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), or automated-decision opt-out (Art. 22).
response_deadline — ISO 8601 datetime by which the controller must respond. Defaults to 30 days from receipt unless extended.
extension_reason — justification for any deadline extension (Art. 12(3) allows up to two further months for complex or numerous requests).
Regulatory context
ASR receipts span GDPR Arts. 15–22 (the full suite of data-subject rights) and Art. 12(3), which sets the one-month response deadline and conditions for extension. A refused request must document the legal basis for refusal and inform the subject of their right to lodge a complaint with a supervisory authority; the request.refused event captures both. Escalation receipts document when a data subject has exercised the right to complain directly.