GDPR data subject rights management and a personal data breach register in a single case file: requests for access, rectification, erasure, objection, portability and restriction with the one-month deadline in view, and breaches with the 72-hour notification to the AEPD, Spain's data protection authority. Panels that open according to the case type, 17 rules that demand what the GDPR and Spain's LOPDGDD demand, the DPO's resolution as a workflow and a dashboard. Dokuflex, the low-code BPM platform with AI, delivers it ready to activate for free in under a minute, with data hosted in the European Union.
GDPR data subject rights management is the circuit for receiving, recording, verifying, resolving and evidencing requests for access, rectification, erasure (the right to be forgotten), objection, portability and restriction (the rights the AEPD groups under the Spanish acronym ARSULIPO) within the one-month deadline (Art. 12(3) GDPR). The personal data breach register documents each incident, its risk level and, where applicable, the notification to the AEPD within 72 hours (Art. 33).
Regulation (EU) 2016/679 recognises in Articles 15 to 22 the rights of access, rectification, erasure, restriction, portability, objection and not to be subject to automated decisions, and in Article 12(3) sets the deadline for handling them: one month from receipt, extendable by two further months depending on the complexity and number of requests, informing the data subject of the extension and its reasons. Organic Law 3/2018 (LOPDGDD), Spain's data protection act, develops the exercise of those rights in its Articles 12 to 18 and adds a rule that changes the way of working: the burden of proving that a response was given lies with the controller (Art. 12.4).
For breaches, Article 33 requires notification to the AEPD "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk to individuals; Article 34 requires communication to the data subjects when the risk is high; and Article 33(5) requires all breaches to be documented, whether notified or not.
| Obligation | Deadline | Rule | If breached |
|---|---|---|---|
| Respond to a rights request | 1 month (+2 with reasons) | Art. 12(3) GDPR; Arts. 12-18 LOPDGDD | Minor infringement (Art. 74.c LOPDGDD) or very serious if repeated or obstructive (Art. 72.1.k); up to €20 M or 4% (Art. 83(5) GDPR) |
| Notify a breach to the AEPD | 72 h from becoming aware | Art. 33(1) GDPR | Up to €10 M or 2% (Art. 83(4) GDPR) |
| Communicate the breach to data subjects | Without undue delay, when the risk is high | Art. 34(1) GDPR | Up to €10 M or 2% (Art. 83(4) GDPR) |
| Document every breach | Always, notified or not | Art. 33(5) GDPR | Without a register there is no way to evidence diligence before the AEPD |
The full circuit of a request (identify, record, count the deadline, respond with reasons, keep the evidence) is explained step by step in GDPR rights request: the circuit to respond within one month (in Spanish).
Most requests come in through info@, the contact form or whichever sales rep is on duty, and are handled by forwarding the email to whoever "knows about this". That system fails in four specific places:
A case file with a non-editable date of receipt, an assigned owner, statuses, rules that demand the mandatory data and a history of who did what solves all four. That is what the module does. To start today with the Article 33(5) register there is the free Excel GDPR breach register template, with the 72-hour deadline calculated from the date of awareness (the template is in Spanish).
The "GDPR data subject rights and data breaches" module is a complete process of Dokuflex, the low-code BPM platform with AI, within the "Regulatory compliance" group of the catalogue. What follows is what it brings out of the box, with the real names of fields and rules.
Automatic case number (RGPD-{seq}), Case type (Exercise of a right / Data breach), Status (Received, In progress, Pending identification, Resolved, Refused, Notified to AEPD, Closed) and mandatory Date of receipt. The Rights request panel collects the right exercised, channel, deadline (1 month, extendable by 2), requester's details, identity verified, representative, extension with reasons and documentation provided. The Data breach panel collects dates of detection and occurrence, type, origin, data categories, number of data subjects affected, risk level, notification to the AEPD, communication to data subjects and measures taken. The shared Processing and resolution panel carries the legal deadline reminder, DPO or person responsible, resolution (upheld, partially upheld, dismissed, inadmissible), date and text of the response, reason for refusal and internal remarks.
Four rules show or hide the panels according to the case type. In a rights case, the right exercised and the requester's name are mandatory; in a breach, the description and the risk level are. If an extension is ticked, the reason appears and is required. If notification to the AEPD is ticked, the notification date appears and is required. With High risk, two rules set notification to the AEPD and communication to data subjects to "Yes" on their own. The Refused status requires the reason for refusal and the Resolved status requires the response to the data subject. Hidden fields are cleared so no data remains from a panel that no longer applies.
The Start processing button saves the case and starts the flow: Pending status, acknowledgement of receipt by email, reading by the requester and the Resolve case step with the Resolve and Refuse buttons. On resolving, the status changes to Resolved and the response date is filled in with today's date; on refusing, it changes to Refused. Every step stays in the case timeline with user, date and time, and the list shows the flow status next to the case status.
Four counters (Received, In progress, High-risk breaches, Resolved) that filter the grid when clicked; columns for number, type, right, requester, date of receipt, deadline, breach risk, status, flow status and DPO, with export to Excel; a kanban by status with the deadline on each card; and a dashboard with six charts: cases by type, rights exercised, status, origin of breaches, cases received per month and resolution.
It is activated from the module catalogue of any Dokuflex account ("Regulatory compliance" group) and is operational in under a minute. It is the same sheet that appears in the template catalogue as DKF-P014, GDPR rights management and DKF-P017, data breaches.
Mutually exclusive rights and breach panels, mandatory fields by type, extension with reasons, high risk that ticks notification and communication, refusal with reasons.
Acknowledgement of receipt by email, reading, resolve or refuse, automatic status change and response date, full history.
Four counters, grid with deadline and DPO, export to Excel, kanban by status.
Six charts: type, rights exercised, status, origin of breaches, received per month and resolution.
A resolved access request, an erasure pending identification, an erasure refused due to a legal retention obligation, a portability request with an extension, a breach caused by human error notified within 72 h and an availability breach with no obligation to notify.
Tours of the form, the list and the dashboard. Any field, status, rule or workflow step can be changed without coding.
Everything is stored on the Dokuflex platform, with data hosted in the European Union, encryption, role-based access control and an audit log of every access (see Dokuflex security). For public administrations and regulated sectors, the platform is aligned with Spain's ENS Medium level: ENS document management.
This module is the rights and breaches piece of GDPR and LOPDGDD software. The record of processing activities (RoPA), the data processing agreement (DPA) and consents and cookies are in the same Dokuflex template catalogue as DKF-P015, DKF-P018 and DKF-P020, so the DPO runs privacy management from a single platform. The module is free; for the rest of the platform, see the Dokuflex plans and pricing.
This is the part of the module you turn to when the AEPD asks. Each case of type Data breach stores what later has to go into the notification: dates of detection and occurrence, type and origin, data categories and number of data subjects affected, risk level, whether the AEPD was notified and when, whether data subjects were informed, and the measures taken. With High risk, two rules tick notification and communication on their own; with Low or Medium risk, the decision is left to the DPO and the case is documented all the same, as Article 33(5) requires.
The six sample case files include two breaches, one caused by human error notified within 72 h and one availability breach with no obligation to notify, to practise both decisions. If the incident also falls under NIS2, the detail of each submission is in NIS2 incident notification: what to send at 24 hours, at 72 and after one month (in Spanish); the official criteria for personal data breaches are in the AEPD breach notification guide (in Spanish).
Many SMEs in Spain still search for an "LOPD" program: the law currently in force in Spain is Organic Law 3/2018 (LOPDGDD), applied together with the GDPR. If in your company privacy is handled by an external DPO, administration or HR, without a dedicated team, what you need is not a suite but software for the DPO with a circuit that works from day one. That is why the module comes configured, with its 17 rules and the DPO's resolution workflow: it is activated for free in under a minute, and the six sample case files let you learn with real cases before the first request arrives. Whatever your organisation does differently is changed afterwards with the low-code designer, and Dokuflex support is in Spanish.
Many breaches, and also some rights requests, involve data that a supplier processes on behalf of the company: the accounting firm, the web host, the payroll delivery tool. The contract with each data processor (Art. 28 GDPR), with its annex of technical and organisational measures and the list of sub-processors, is in the template catalogue as DKF-P018, data processing agreement. In this module, the low-code designer lets you add the processor involved to the case, so you know which supplier was involved in each case.
The module belongs to the "Regulatory compliance" group of the catalogue, alongside other free modules that share the same logic of case file, deadlines and evidence: the NIS2 and DORA incident register, ISO 27001 and ISO 9001 nonconformities and corrective actions, the KYC due diligence file and the AI systems register. If a breach reveals a control failure, the corrective action is recorded as a nonconformity, with its root cause and its effectiveness check.
Any organisation that processes personal data receives requests and suffers incidents; these four profiles are the ones with the least room to lose them.
Marketing opt-outs, account deletions and access to customer data that arrive daily through the web form. The case file records them with their channel and closes them with the response saved; invoices that cannot be deleted are dismissed with reasons.
Special-category data and a mandatory DPO. Access to medical records or case files, breaches caused by sending to the wrong recipient and communication to data subjects when the risk is high, with the notification date required by the system.
Requests from residents, users and employees through the electronic or in-person registry, with a designated DPO and their own sanctions regime (Art. 77 LOPDGDD). Numbered case file, reasoned resolution and exportable evidence for the body's register.
Access by employees and former employees to their file, payroll rectifications and typical HR breaches (payslips sent to the wrong recipient, lost laptops). A single circuit for the DPO and for the HR manager.
The GDPR data subject rights and data breaches module is free and is activated from the module catalogue of any Dokuflex account in under a minute. The Dokuflex platform has plans from €25 per user per month (Starter plan, with an annual subscription) and a free 14-day trial environment, with no credit card and no commitment. The details are on the Dokuflex pricing page.
This module covers the rights request case file and the breach register, with their deadlines, rules and evidence. It does not by itself include the record of processing activities (RoPA), the data processing agreement (DPA) or consents: those pieces exist as separate templates in the Dokuflex catalogue (DKF-P015, DKF-P018 and DKF-P020), so the DPO works on everything from a single platform.
One month from receipt, extendable by two further months depending on the complexity and number of requests, informing the data subject (Art. 12(3) GDPR). The old Spanish ARCO rights (access, rectification, cancellation and objection) are today access, rectification, erasure (the so-called right to be forgotten), objection, portability and restriction (ARSOPL), plus the right not to be subject to automated decisions (Arts. 15 to 22). The deadline is the same for all of them. The module records the date of receipt and the deadline of each request.
Article 33 GDPR sets 72 hours from becoming aware of the breach, counting weekends and public holidays, unless it is unlikely to result in a risk to individuals. If you decide not to notify, Article 33(5) still requires the breach to be documented. The module records both decisions; the notification to the AEPD is submitted by the organisation and the case file records when it was done.
The case file records the date of receipt, which is mandatory, and the deadline (one month, extendable by two) next to it; both appear as columns in the list and on the kanban cards, and the counter of cases received and in progress shows how many are still open. An extension requires its reason to be stated, which is what has to be communicated to the data subject. The exact calculation of the deadline and its communication remain the DPO's responsibility.
When the High risk level for data subjects is selected, two rules automatically set Notify the AEPD (72 h) and Communicate to data subjects to Yes, and the date and time of notification to the AEPD appears as mandatory. The case cannot be closed without that data. With Low or Medium risk the boxes are left to the DPO's judgement, and the case is documented all the same, as Article 33(5) GDPR requires.
Yes, that is the module's design. The Case type field opens the rights request panel (right exercised, channel, requester, identity verified, representative, extension, documentation) or the data breach panel (dates of detection and occurrence, type, origin, data categories, data subjects affected, risk, notification and measures), never both. The processing and resolution panel, with the DPO, the resolution and the response, is shared.
The case has a DPO or person responsible field and a workflow with the steps Pending, Acknowledgement of receipt by email, Reading by the requester and Resolve case, where the Resolve and Refuse buttons appear. On resolving, the status changes to Resolved and the response date is filled in with today's date; on refusing, it changes to Refused and the reason for refusal is mandatory. Every step stays in the case history with user, date and time.
No. The module gives traceability and evidence: it records each request and each breach with its dates, demands the data the law demands, keeps the response and the history, and flags what is missing. Deciding whether a request is upheld or refused, whether a breach poses a risk and what is communicated is the responsibility of the organisation and its DPO. What the module guarantees is that the decision is documented and on time.
Yes. The module installs as one more Dokuflex process and is edited with the low-code designer: add fields (for example, the data processor involved), change the statuses, add a second approver to the workflow or connect the acknowledgement of receipt to your own email template. The 17 rules included can be modified or extended without coding.
On the Dokuflex platform, with data hosted in the European Union, encryption at rest and in transit, role-based access control and an audit log of every access and change. The documentation provided by the requester is stored inside the case file, not in the mailbox of whoever received it. The platform's security measures are detailed on the Dokuflex security page.
No. The module is free and is activated from the module catalogue of any Dokuflex account in under a minute, with no card. It comes with six sample case files and three guided tours (form, list and dashboard) to practise the circuit, and is then adapted with the low-code designer, without coding. The Dokuflex product and support are in Spanish.
As data processors, with the contract under Article 28 GDPR. The Dokuflex catalogue offers it as template DKF-P018, with an annex of technical and organisational measures and a list of sub-processors. In the rights and breaches case file, a field with the processor involved can be added with the low-code designer, to identify which supplier was involved in each breach or request.
The breach affects personal data and, unless it is unlikely to result in a risk, is notified to the AEPD within 72 hours (Art. 33 GDPR). A significant NIS2 incident is reported to the CSIRT or the competent authority: early warning within 24 hours, notification within 72 and final report within one month. The same incident can be both; the NIS2 part is handled in the NIS2 and DORA incident register.
No. The notification is submitted at the AEPD's electronic office, with the Comunica-Brecha RGPD form. The case file records whether it was notified and the date and time of the notification, which with High risk is mandatory and without which the case cannot be closed, and keeps the decision not to notify when the risk is low, as Article 33(5) requires. It is the evidence that it was done and when; the submission is made by the organisation.
No. The module covers rights requests and breaches. The record of processing activities (RoPA) is in the Dokuflex catalogue as template DKF-P015, and the impact assessment (DPIA) for high-risk processing is managed as a controlled document in the document management system, with versions and change control, so it is at hand when a breach affects that processing.
It complements it. Facilita RGPD is the free tool from the AEPD, Spain's data protection authority, that helps companies with low-risk processing to generate the initial documentation: record of processing activities, information clauses and data processing agreement. It does not manage the day to day. The Dokuflex module takes care of what comes next: each rights request and each breach with its deadline, its owner, its resolution and its evidence.
Guidance prepared by the Dokuflex Compliance Team. For specific cases, consult your DPO, your legal adviser or the AEPD.
Related reading: the internal circuit of a GDPR rights request (in Spanish), LLM and RAG under the EU GDPR and passkeys: passwordless identification. If you want to estimate the time saved by handling cases in a case file instead of by email, use the ROI calculator.
Activate the GDPR data subject rights and data breaches module for free in your Dokuflex account, try it with the six sample case files and adapt it with the low-code designer. Or request a demo and we will walk through it with your DPO.