Handling access requests & deletion in everyday life

Which rights these are

• Access: finding out which data you store
• Correction: having incorrect data corrected
• Deletion: having data removed when it is no longer needed

These three rights are the ones you meet most often. For all of them: they must be answered – not only as fast as possible, but completely.

Knowing where the data lives

The most important preparation is an overview: where does which data lie? In administration, in communication, in notes and recordings. Whoever knows that can answer a request instead of searching first.

A tool that bundles the data in one place makes that overview clearly easier – instead of spreading data across chats, folders and paper notes.

Giving access

An access request must be complete, but not elaborate. It is enough to compile the stored data and answer understandably. An export from a well-kept system is worth gold here.

The only unclear part is often who may ask – for minors, for example, the legal guardians. When in doubt, verify identity before handing out data.

Carrying out deletion

Deletion means: actually removing the data, not just removing it from view. A system with a real deletion function makes that easy – and avoids leftovers in chats or backups that get forgotten.

Not everything may be deleted immediately: retention periods – for invoices, for example – take priority. Whatever goes beyond that should be removable without hesitation.

Handle a request in an orderly way

Set up a simple process before a request arrives: who receives it, who verifies identity and who gathers information from the systems in use? Record when it came in and clarify which person or organisation is responsible. At a music school, several teachers or administrative areas may be involved; one contact point helps keep the response consistent.

Keep a record of the request and the steps taken so the handling can be understood later. Do not disclose data before checking that the requester is entitled to receive it. If the scope or deadline is unclear, seek qualified guidance early rather than waiting until the last moment.

Provide access information clearly and securely

A response should not be an unexplained collection of files. Organise the information by category and explain in plain language what data is processed and for what purposes. Check that information about other people is not included by mistake, for example in group notes or shared documents.

Use an appropriately protected channel for delivery and record what was sent. An internal list of data sources—accounting, calendar, learning platform and local storage—helps make the search systematic. For complex requests involving linked accounts, involve the person responsible for privacy.

Balance deletion against retention duties

Before deleting information, check whether particular records must be kept for another reason. Invoices may be subject to different retention periods from lesson notes or recordings that are no longer needed. Separate what can be deleted from what must be restricted or kept with limited access.

Remember copies and connected systems too: exported files, shared folders, email attachments and backups. Backups may not always be editable immediately; the provider’s rules should be understood, and deleted material should not reappear in normal access. Record what was removed, when, or why it had to be retained.

Limit access and test the process periodically

Access and deletion requests often involve sensitive information. Restrict access to people handling the request and avoid private devices or unsecured messaging apps as storage. A clear route for responsibility also makes it easier to respond within applicable time limits.

Once a year, the organisation can walk through an example: where would we find the data, who needs to be involved and how would we record deletion? This can reveal an outdated list or an application that was missed. Qualified legal or privacy advice should guide binding deadlines and exceptions.

How MUSIRIS supports these rights

MUSIRIS bundles the lesson data in one place and offers export and deletion functions. Access and deletion become a few steps – instead of a search across several systems.

You can try MUSIRIS for free. Think once about where your lesson data currently lives – and what an access request would cost today.