Self-service data subject rights for the people who have left

Why data subject requests need a system

Written for technical HR roles, this page covers the common data subject rights that apply across active and legacy applications, whether they are hosted in-house, in the cloud or by a third party.

Increasingly, HR and payroll service inboxes are targets of attempts to extract personal information and payment data. Fuse leverages the historical data archive to validate users in a credit-file-style security challenge process, backed by multi-factor authentication.

Data subject requests are also becoming part of the helpdesk function, where they are often handled ad hoc and are not centrally reported or managed efficiently end to end. This exposes organizations to increasing data privacy compliance risks carrying real and significant monetary impacts.

What the self-service portal does

Fuse offers a self-service feature where affiliated persons can be invited to access their own profiles online long after the business or employment relationship has ended, in order to:

• Cut the risk of emailed phishing attempts aimed at HR and payroll service inboxes requesting personal information.
• Reduce ticketing traffic for individual historical data requests.
• Deploy multi-factor authentication.
• Centralize the data privacy requests of former employees, contractors and applicants for audit and compliance.
• Implement the data subject rights of CCPA privacy compliance for enterprise personal information.

What are data subject rights under CCPA?

• Right to notice (notification)
• Data access
• Opt-out (where applicable)
• Request deletion
• Right to equal services

Further information on consumer rights under the CCPA

What are data subject rights under GDPR?

• Transparency and communication
• Information and access to the data
• Rectification and erasure
• Data portability
• Objection to or restriction of processing

Further information: GDPR Chapter 3, rights of the data subject

How are these features delivered?

Terminated persons may be invited to the self-service portal, where they are able to:

• View the company privacy policy statement(s).
• View their own data (access).
• Download encrypted PDF copies of their information (portability).
• Request that personal data such as email, address and names be corrected and updated (rectification).
• Be notified of, and log, changes to their data where applicable.
• Formally request that their PII be purged after the business use expires (request deletion).
• Handle verification of employment requests, pay information and W-2 history.

The portal draws on the historical data archive, so a request can still be answered after the system that originally held the records, whether UKG, ADP, Workday, SAP or Dayforce, has been retired. See how retention rules and purging fit together on the compliance page, and how the platform is protected on the security page.