Data subject requests
Handle requests to access, correct or erase personal data within the legal deadlines.
Under the Data Protection Act, 2019, people can ask to see the personal data held about them, have it corrected, object to its use or have it erased. Sauti handles these requests centrally with your campaign, because supporters' contact details are sealed and only Sauti's data protection staff can locate them safely.
If a supporter contacts your campaign#
- Do not ignore it. The legal clock starts when the request is received.
- Forward it to the Sauti privacy contact listed on the privacy notice, with the date and channel it arrived on. Do not paste the person's number into chat groups.
- Tell the person their request has been passed on and they will hear back.
If someone only wants to stop messages, they can reply STOP, ACHA or SITAKI. That takes effect immediately. See Opt-outs, quiet hours and caps.
How Sauti handles the request#
Sauti's data protection officer records the request with its deadline and works it in three steps:
- Verify the requester before any action.
- Locate the protected records across your organisation.
- Resolve it:
| Request | Outcome |
|---|---|
| Access | An access report of the data held |
| Rectification | Names, gender, birth details, language or a corrected contact are updated |
| Objection | The person is suppressed platform-wide from political messaging |
| Erasure | The person's data is erased, including related import copies and generated exports, and a suppression hash is kept so they are never messaged again |
Every step is audited. Your campaign is told when a request involving your data is completed.
Complaints about a message#
Recipients can report an unwanted message using the reference in the message on Sauti's complaint page. Complaints go to Sauti's compliance team and set a platform-wide suppression for that person.