Whenever you receive a GDPR request, please make sure you are handling it by following this workflow:

IF YOU ARE NOT AUTHORIZED TO WORK GDPR TICKETS IT NEEDS TO BE ESCALATED.

IF A USER MENTIONS THE GDPR, REQUEST THAT WE DELETE THEIR ACCOUNT, OR TO REMOVE THEIR INFORMATION, ESCALATE THE TICKET

IF YOU ARE NOT 100% SURE THAT ITS A GDPR TICKET, YOU NEED TO ESCALATE THE TICKET.

IF YOU HAVE ANY CONCERNS ABOUT IF THE USER IS GDPR ELIGIBLE YOU NEED TO ESCALATE THE TICKET.

1. 1. User submits a support ticket making some data request (deletion, export, or other)

2. If the account is not found

1. Reply with “*GDPR

Data Request any time account cannot be found- 09/18*” macro.

2. Work with the user to try to identify an account in the system 3. If the account is found

1. Select the relevant option

1. Reply with *“GDPR

Deletion Request and account is found - 09/18”* macro or...

2. Reply with “GDPR:: Export Request and account is found - 09/18” macro or... 3. Reply with “GDPR:: Data request that is neither deletion nor export and account is found - 09/18 ” macro 2. Look up the user in admin.hsselite.com

1. Check if the user is GDPR eligible

1. In the "user details" section, find the row titled ‘GDPR’. This row will indicate eligible/not-eligible

1. If the user is eligible

1. Click the “details” link 2. Click the “create new request” button