{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Data Protection & Privacy","type":"corrective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-08","description":"Operate a verified rights-request process with designated intake channels, identity verification, and statutory response clocks that executes data-subject rights including erasure/deletion, portability, restriction, objection, and rights related to automated decision-making, and directs service providers to do the same. Do not discriminate or retaliate against individuals for exercising rights, and disclose the material terms of any financial-incentive program with opt-in consent. Track every request end-to-end as evidence.","details":{"control_category":"administrative","control_type":"corrective","domain":"Data Protection & Privacy","guidance":[],"members":[{"control_id":"GDPR-Art15-22","coverage":"partial","delta":"Art 22 standing automated-decision prohibition and Art 19 recipient notification exceed request handling","framework":"gdpr","relationship":"intersects_with"},{"control_id":"CCPA-1798.105","coverage":"partial","delta":"notifying third parties (beyond service providers) to delete sold/shared data omitted","framework":"ccpa","relationship":"intersects_with"},{"control_id":"CCPA-1798.130-135","coverage":"partial","delta":"homepage 'Do Not Sell/Share' links and opt-out preference-signal (GPC) handling omitted","framework":"ccpa","relationship":"intersects_with"},{"control_id":"CCPA-1798.125","coverage":"full","framework":"ccpa","relationship":"superset_of"}],"statement":"Operate a verified rights-request process with designated intake channels, identity verification, and statutory response clocks that executes data-subject rights including erasure/deletion, portability, restriction, objection, and rights related to automated decision-making, and directs service providers to do the same. Do not discriminate or retaliate against individuals for exercising rights, and disclose the material terms of any financial-incentive program with opt-in consent. Track every request end-to-end as evidence.","title":"Execute deletion and other rights requests within deadlines","unified_id":"UC-DATA-08"},"id":"uc:UC-DATA-08","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-08","sourceIds":["ccpa","gdpr"],"sourceUrl":null,"title":"UC-DATA-08 — Execute deletion and other rights requests within deadlines","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5ed1c248bc7ad0fa6172f058cb28b870525e43a8d7677363c3fb0fab266e1f7c","properties":{"control_id":"CCPA-1798.105","coverage":"partial","delta":"notifying third parties (beyond service providers) to delete sold/shared data omitted","framework":"ccpa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"CCPA (2018) as amended by CPRA (2020)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-105-fdc06468.json","targetId":"ctrl:ccpa:CCPA-1798.105","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9675e11635b80d5c85fe22d26aa4c26e65d945d72c3bf7c0a25dd9f24d02e0cb","properties":{"rationale":"No-discrimination/retaliation rules and automated-decision-making rights curb algorithmic gatekeeping and unwarranted restriction.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/risk-data-privacy-harms-to-individuals-510e65af.json","targetId":"risk:data-privacy-harms-to-individuals","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e37e898082c14bfbe659c24feed0d0d1b518d918031c210a3466e77f28c45bc","properties":{"control_id":"CCPA-1798.125","coverage":"full","delta":null,"framework":"ccpa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"CCPA (2018) as amended by CPRA (2020)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-125-f0016e3a.json","targetId":"ctrl:ccpa:CCPA-1798.125","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bd9fc26d2c6769c24d75fd5160ee8ea0890c901e9bd59e1c6b52910e8bd5a696","properties":{"control_id":"CCPA-1798.130-135","coverage":"partial","delta":"homepage 'Do Not Sell/Share' links and opt-out preference-signal (GPC) handling omitted","framework":"ccpa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"CCPA (2018) as amended by CPRA (2020)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-130-135-f5dd6b5b.json","targetId":"ctrl:ccpa:CCPA-1798.130-135","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d68b28c66a86af15f0fd0c2760726edeff80a9b09cf987d8124192e19e8ee85c","properties":{"control_id":"GDPR-Art15-22","coverage":"partial","delta":"Art 22 standing automated-decision prohibition and Art 19 recipient notification exceed request handling","framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art15-22-256fff35.json","targetId":"ctrl:gdpr:GDPR-Art15-22","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d87f115fdbef50bd52106f58ee1b2e0ebacdc5a152c961fe436b0015ec9d2659","properties":{"rationale":"Executing erasure requests deletes specific subjects' data, reducing unlawful over-retention.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/risk-data-retention-noncompliance-ec7b8dbc.json","targetId":"risk:data-retention-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ea7b0f02af40eff5e0f538783b7ce78a185f3b1ca45a83e4c65e6f9d8510efdc","properties":{},"sourceDetailPath":"/data/v1/records/wf-r7-2fc6568b.json","sourceId":"wf:R7","targetDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","targetId":"uc:UC-DATA-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb3246a4e1cba415c2efa0d2ed40ce4947a226ac4a39637acc1c127df8cf7d1b","properties":{"rationale":"Operating deletion, restriction, and objection rights directly restores individuals' ability to delete and restrict processing of their data.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/risk-privacy-power-imbalance-self-determination-9112ad1d.json","targetId":"risk:privacy-power-imbalance-self-determination","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f904d64067d0121654ee8d018acdf44e96484364813f8f3778bfcbc227893874","properties":{"rationale":"A verified process executing erasure/portability/restriction/objection within statutory clocks is the core defense against failing to honor DSRs on time.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"}],"schemaVersion":1}