Handling Data Requests

Privacy laws give people the right to ask what personal data you hold about them, and to ask you to correct or delete it. Under GDPR you generally have one month to answer. Data Requests gives you a place for those requests to arrive, a record of what you did about each one, and a deadline attached to every request so none of them quietly expires.

Data Requests is a SureCookie Premium feature. On the free plugin the screen explains how the workflow works, but requests cannot be received or handled.

Visitors submit requests through a form you publish on your site. Every request is confirmed by email before it reaches you, so nobody can file a request in someone else’s name.

Step 1: Turn On Data Requests

1. Go to SureCookie → Data Requests.
2. Open the settings for the feature and turn on Enable Data Requests.
3. Enter the address that should hear about new requests under Notify Admin at.
4. Set Response Deadline (days). The default is 30, which suits the GDPR one-month deadline.
5. Click Save.

Tip: Use a monitored shared mailbox for Notify Admin at, not a personal address. A statutory deadline should not depend on one person reading their email.

Step 2: Choose Which Rights to Offer

Allowed Request Types decides what visitors can ask for. Types you disable are hidden from the form.

Group	Types	What the visitor wants
Export	Access, Portability, Rectification	A copy of their data, or a correction to it
Erase	Erasure, Objection, Restriction	Their data deleted, or your use of it stopped
Other	Other	Anything that does not fit the above

1. Under Allowed Request Types, select the rights you want to offer.
2. Click Save.

Important: Which rights you must offer depends on the laws that apply to you, not on which are convenient. Confirm the list with whoever advises you on compliance before narrowing it.

Step 3: Publish the Form

You can let SureCookie place the form for you, or position it yourself.

To place it automatically, turn on Auto-add to Privacy Policy page. SureCookie appends the form to the Privacy Policy page configured in WordPress, and no shortcode is needed there.

To place it yourself, copy the shortcode under Form shortcode using Copy shortcode, then paste it into any page:

You can also change how the form reads:

• Form Heading – The heading above the form. Defaults to Submit a Data Request. Leave it blank to hide the heading.
• Form Description – Text shown above the form, for anything visitors should know before submitting.

Note: If you turn on auto-insert and also place the shortcode on the Privacy Policy page, the form still appears once. SureCookie will not render it twice on the same page.

Step 4: Work Through the Queue

Requests arrive on SureCookie → Data Requests, listed with their ID, Requester, Type, Status, Submitted date, and Deadline.

A request moves through these states:

• Pending verification – Submitted, but the requester has not clicked the confirmation link yet. It is not yet your responsibility.
• Received – Confirmed and waiting for you. The deadline is now running.
• In progress – You have started work. The requester is told their request is being handled.
• Responded – You have replied.
• Closed – Finished and filed.
• Rejected – Declined, with a reason recorded.

Click a row to open the request. The panel shows the Name, Email, Type, Submitted date, Source page, and, where SureCookie can match it, the SureCookie session ID that links the request to that person’s consent history.

Note: Unverified requests are deleted automatically after 7 days. Somebody who submits a request and never confirms it leaves nothing behind on your server.

Step 5: Reply to a Request

1. Open the request and choose Reply.
2. Write your Message.
3. For an access or portability request, click Export data to generate the file, then Preview to check it before it goes anywhere.
4. Click Send response.

You can also Mark closed when no reply is needed, Reject request with a Reason, or Archive request once it is finished with.

Important: The export is gathered from every personal data exporter registered on your site, so it can include data held by WordPress core and your other plugins alongside SureCookie’s own consent and request records. Always use Preview and read the file before sending it. You are emailing personal data to an address that came from a public form.

Exports are deleted automatically once your retention period passes, which is 3 days by default, so dossiers do not accumulate on your server.

Requests Made Through WordPress

SureCookie also registers with WordPress’s own privacy tools. A request you handle from Tools → Export Personal Data or Tools → Erase Personal Data includes the data SureCookie stores, so you get a complete answer whichever route you use.

Keeping to the Deadline

Every confirmed request carries its own deadline, calculated from Response Deadline (days). Once a day SureCookie emails a summary of what is overdue and what is due soon to your Notify Admin at address.

Tip: If the daily summary never arrives, the rest of the queue is still fine, but you have lost your safety net. See Troubleshooting below.

Troubleshooting

• The form does not appear on the page. Confirm Enable Data Requests is on. The shortcode renders nothing while the feature is off.
• Auto-insert is on but no form appears. WordPress has no Privacy Policy page set. Choose one under Settings → Privacy.
• Requesters never receive the confirmation email. Your site cannot send email reliably. Install an SMTP plugin and send a test, then ask the requester to submit again.
• No daily summary arrives. The summary runs on WP-Cron. If your host has disabled WP-Cron, or your site gets very little traffic, scheduled tasks may not fire. Check your queue manually until cron is working.
• A request shows no session ID. SureCookie could not match the requester to a consent record, usually because they consented on another device or cleared their cookies. Handle the request as normal.
• The export is empty or smaller than expected. Nothing registered on your site returned data for that email address. Confirm the address matches the one they use on your site.

Next Steps

Submit a test request through your own form and take it all the way to a reply. It is the quickest way to confirm your emails send, your deadline is right, and the export contains what you expect.