Privacy Rights Manager

Privacy Rights Manager lets you set up channels to receive privacy rights requests and manage their fulfilment through structured workflows, clear ownership, and consistent communication. A data subject submits a request on one of your intake forms, or your systems submit it through the Integration API. Neostra verifies the requestor, starts the right workflow, assigns tasks, tracks the deadline, and gives the data subject a portal to collect the answer. The module's menu has Dashboard, Request Queue, Tasks, Intake Forms, Workflows, Response Templates, and Request Types.

The building blocks

Request type. The right a person exercises, for example access, correction, or erasure. Each has an internal identifier and a display name translated into every language your forms support. Manage them under Request Types.

Intake form. The public form a data subject fills in. You choose which request types it offers, add fields, set languages and translations, turn on attachments, and decide whether email verification and an affidavit are required. Its rules route each submission to a workflow, brand, and owner, and set the deadline. Forms are edited as drafts and published; the public link and embed snippet serve the latest published version. Manage them under Intake Forms.

Workflow. How a request type gets done. A workflow belongs to a brand, is tagged with regulations, and contains an ordered list of stages. Each stage holds tasks with assignees, a response type, and a due-days value. Rules can enable or disable steps based on the answers, or send an email or call one of your APIs when the request starts, a stage changes, or the request completes. Workflows publish as named versions, and a request keeps the version it started with. Manage them under Workflows.

Response template. Reusable message text per language, assigned to one or more brands, inserted when writing to the requestor. Manage them under Response Templates.

Request. One submission from one person: requestor details, verification state, tags, and one workflow instance per request type with its own owner, stage, and due date. Work them from the Request Queue.

Task. One unit of work inside a stage, assigned to one or more people who answer it, add notes, and upload files. Listed under Tasks.

Data subject portal. The requestor's view. They sign in with their email address and a one-time code valid for five minutes, see their requests, download exported files as one ZIP from the Data tab, and exchange messages and files from the Messages tab.

Integration API. A second channel next to the form. Your systems submit requests and read their status with an API token. See Integration API.

The request lifecycle

Request statuses

Deadlines

The request deadline comes from the intake form rule that matched the submission. Each rule sets a number of due days and whether they count as calendar or business days. Business days skip Saturday and Sunday. Each task also carries its own due-days value, so assignees see a task due date as well as the request due date.

An owner can extend a request deadline once, adding calendar or business days with a reason. The extension is recorded on the request.

Who does what

How it connects

• Privacy Center. A privacy center page can embed an intake form as a section, next to privacy notices and preference centers, so data subjects have one place for everything. See Privacy Center.
• Consent Management. Preference centers built there sit alongside intake forms in the same privacy center. See Consent Management.
• Webhooks. Advanced workflow rules call your APIs when a request starts or completes, or when a stage or task changes. See Webhooks.
• Integration API. Submit requests and read their status from your own systems. See Integration API.

Explore the module