Under the EU GDPR, a data subject access request asks whether personal data about the requester is being processed and, if so, seeks access to that data, a copy and related processing information.[1] It exercises a privacy right, rather than merely requesting another purchase invoice.
Look beyond the customer account to relevant linked records. Arrange secure identification and delivery so that responding to the request does not itself disclose information to an unauthorised person.
Content updated:
Sources
Compiled with AI assistance using public sources. General explanation, not individual legal or tax advice. Describing a concept does not mean Zoloo offers it as a feature.