Rights ManagerOne place to receive, resolve, and prove every data subject request.
Rights Manager centralizes requests, verifies the data subject's identity, and keeps the evidence you need to demonstrate compliance under Law 21.719.
- Centralize every request
- Verify identity
- Track deadlines
- Keep auditable evidence
- Centralize every request
- Verify identity
- Track deadlines
- Keep auditable evidence
Summary
- KQM-4821Verifying identityResolvedARSOPAccessValentina Sotovalentina@correo.clNo due dateAwaiting verificationClosedTodayUnassignedMLMaría L.
- BRT-4819In progressARSOPErasure and restrictionJorge Muñozjorge.munoz@correo.clCritical2 days leftCRCarla R.
- HZP-4816In progressARSOPRectificationAna Pérezana.perez@correo.clDue soon6 days leftMLMaría L.
- XKD-4812In progressREDECREDEC updatePedro Lagospedro.lagos@correo.clOn time11 days leftJPJosé P.
- QWE-4807Not verifiedARSOPObjectionRosa Tapiarosa.tapia@correo.clNo due dateAwaiting verificationUnassigned
- LMN-4803ResolvedARSOPPortabilityLuis Veraluis.vera@correo.clClosedTodayCRCarla R.
Rights requests / Request details
Identification and contact details
- ID number
- 12.345.678-9
- valentina@correo.cl
Identity verification
Related workflows
Access requestsIn progressSummary
ResolveRight
Status
Deadline
Owner
Activity history
- Request assigned09:48The “Access requests” workflow assigned the request to María L.
- Identity verification completed09:47The user completed identity verification.
- Request submitted09:41Right of access request received.
- Request created09:41The request has been logged and is ready to be handled.
- TriggerRights request receivedStartIn progressAction requiredCompletedRuns when a request enters processing.
- Assign requestIn progressAction requiredCompletedMaría L.
- Send HTTP requestIn progressAction requiredCompletedGET https://crm.acme.cl/api/clientes
- Form requestIn progressAction requiredCompletedAssigned to María L.
- Transition requestIn progressAction requiredCompletedClose as approved
Trusted by privacy leaders at:
Answering on time depends on three things that tend to fail at once.
Legal receives the request, technology carries it out, marketing updates the databases. None of those teams sees the whole process end to end.
Example: an access request
- Day 4Assumed, or an ID copy requested by email
Re: Access request
To continue, please send us a photo of both sides of your ID card.
carnet.jpgUnverifiedWho is asking
Unverified identity
Few organizations have a reliable way to confirm that the person asking is the data subject. Handing data to the wrong person is worse than not answering.
- Day 19Searched by hand, one system at a time
- CRM
- App
- Call center
- Legacy systems
- Spreadsheets
- Vendors
3 of 6 systems checked
Where the data is
Fragmented data
A data subject's information lives in the CRM, the call center, the app, legacy systems, and spreadsheets. Without an organized record of processing activities, finding all of it within the legal deadline isn't realistic.
- Day 29The answer is pieced together afterward
Response record
- What was requestedNot recorded
- What was deliveredNot recorded
- How long it tookNot recorded
- Which channelNot recorded
What was recorded
Lost evidence
The request gets answered, but nothing records what was asked, what was delivered, how long it took, or through which channel. When the regulator comes asking, there is nothing to show.
If any one of the three fails, the response won't hold up to whoever reviews it.
Rights ManagerEvery request becomes a case with an owner, a deadline, and auditable evidence.
What used to be coordinated over email is documented in one place, with a record of every action and every response.
A portal inside your privacy center
The request form and status lookup are embedded on your site, in public or signed-in mode, with your brand's look and feel.
Read the docs (in Spanish)Configurable identity verification
Government database checks, document reading, or a liveness test, depending on the level your organization sets.
Read the docs (in Spanish)Deadlines and due-date alerts
Each case is assigned to a person, with its status and time remaining. Cases close to their deadline are flagged and grouped in their own view.
Read the docs (in Spanish)Configurable workflows
Waits, notifications, calls to other systems, and human approval steps within the same flow.
Read the docs (in Spanish)Auditable evidence
Every request, every response, and the files attached at resolution are recorded with date and author, in a format that holds up during an inspection.
Read the docs (in Spanish)Law 21.719 and REDEC rights
The same flow covers the six data subject rights and requests under Chile's Consolidated Debt Registry.
Read the docs (in Spanish)
How Rights Manager works
What happens today when a customer asks for their data? Here is the full journey, from the form the data subject fills out to the documented response.
1Public form
The data subject chooses which right to exercise, with the explanation right beside it
Read the docs (in Spanish)Rights explained in the moment. Access, rectification, erasure, objection, and portability, each with an example of when it applies.
Restriction when it applies. When objecting, rectifying, or requesting erasure, the data subject can ask for processing to be paused while the case is resolved. The law doesn't allow requesting it on its own.
Public or signed in. The same component works on your public site or inside a signed-in session, with your brand's look and feel.
acme.cl/centro-de-privacidadExercise your rights
These rights are granted by law and can't be transferred or waived.
Right you want to exercise
2- AccessFind out what data they hold, who has it, and why.
- ObjectionStop your data from being used for certain purposes.
- RectificationCorrect inaccurate or outdated information.
- ErasureDelete your data when it's no longer needed.
- PortabilityGet a copy to take to another service.
Select a right to see an example of when it applies.Example: “I want all my data deleted because I canceled my subscription.”Restrict the use of my data while the request is resolvedIf you prefer, we can stop using it until we resolve your request.ContinueIdentification and contact details
Request sent
We sent you an email with the details and your tracking code.
CodeKQM-4821Verifying2Verification
Identity verification is what clears the request for processing
Read the docs (in Spanish)Three checks you can combine. Government registry lookup, document reading with data extraction, and a liveness test, at the level your organization sets.
Optional or required. By default, the data subject can submit the request and verify later, and your organization can require verification to complete submission.
Status visible on both sides. The case waits for verification, and the data subject receives a code to follow its progress.
Let's get started!
In the next steps, we will:
- Take a selfie to verify your identity.
- Scan your ID document.
- Validate your document with the Civil Registry.
Move closer and fill the oval
Analyzing your selfie
Front of your ID card
Make sure it's sharp and legible
We're checking your document's validity with the Civil Registry
Identity verified
Identity verification
Not verifiedVerifying identityIn progress- Liveness check
- Document scanNameValentina SotoRUT12.345.678-9
- Government check
CaseKQM-4821No due dateAwaiting verificationOn time30 days left3Case management
Every case has an owner, a status, and a deadline in plain sight
Read the docs (in Spanish)Internal assignment. The request goes to the right person on the team, and the change is logged in the history.
Deadlines in plain sight. Views separate active, due soon, overdue, and resolved cases, and each right shows whether it's on time, due soon, or critical.
Documented resolution. Each case is accepted, partially accepted, or rejected, with the response to the data subject, the files that go with it, and the internal reason on record.
Operational metrics. Request volume, cases in progress, resolved cases, and average response time.
dashboard.soyio.idBRT-4819In progressResolvedSummary
Resolve- Right
- Erasure and restriction
- Status
- In progressPartially accepted
- Deadline
- Due soon6 days leftClosedToday
- Owner
- UnassignedMLMaría L.
- MLMaría L.
- CRCarla R.
- JPJosé P.
Activity history
- Resolution16:05Resolved by María L.
- Request assigned10:12Carla R. assigned the request to María L.
- Identity verification completed09:47The user completed identity verification.
- Request created09:41The request has been logged and is ready to be handled.
Resolve request
This will close the ticket and notify the requester by email.
Resolution type
AcceptancePartial acceptanceRejectionInternal reason (internal use only)
Reviewed with legal. Marketing data is deleted; invoices are kept to meet tax obligations.
respuesta-titular.pdf
CancelSend resolution4Automation
Automation moves the case forward; the decision stays human
Read the docs (in Spanish)Flows that wait, notify, and query. A workflow can start when the data subject is verified, wait for a set period, alert the team, query another system, or close a case that never moved forward.
Approvals with a human in the loop. Steps that need judgment are resolved in a form sent to the person responsible.
Tested before publishing. Every flow starts as a draft, is tested against an existing request, and only runs automatically once published.
Access requestsDraftTest triggerIn progressCompletedThis workflow isn't published yet
- TriggerRights request receivedWhen the request enters processing
- Send emaillegal@acme.cl
- Send HTTP requestGET https://crm.acme.cl/clientes
- Form requestAssigned to María L.Action required
- Transition requestClose as approved
- Trigger
The clock starts before your team has the answer.
Book a demoWhat changes with Rights Manager
| Area | Email and spreadsheets | With Soyio |
|---|---|---|
| Intake | Requests spread across inboxes | A single intake channel |
| Identity | Assumed or requested by email | Verified before processing |
| Deadlines | Tracked by hand | Due-date alerts per case |
| Ownership | Depends on who's available | Explicit assignment per case |
| Coordination | Email threads between teams | Workflows with defined steps |
| Evidence | Pieced together afterward | A history of every action |
The rights portal lives where users already manage their consents.
The privacy center is the component your organization embeds on its site. From there, users submit rights requests, check the status of each one and, if your organization uses the Consent module, manage their consents without leaving the portal.
One component to install. Identity verification is built in, with no separate integration.
Public and signed-in modes. It works on your public site or inside a signed-in session.
Data subjects check their own case. With the code they receive by email, they can see the status of their request without calling or writing to the call center.
Privacy center
We want you to be in control of your personal data. That's why we created this space, where you can review your permissions and exercise your rights easily.
- Exercise your rightsAsk to know, correct, delete, or restrict the use of your data.
- Request trackingCheck the status of your requests.
Request tracking
Enter the tracking code we sent to your email to check the status of your request.
Request details
Under reviewRequestKQM-4821
Erasure and restrictionResponse due in 30 daysUnder review
Activity history
- Request received
- Identity verification
- Under review
More articles to read
"Without undue delay": the clause that can trip companies up under the updated data protection law
6 min read · Jun 26, 2026
A practical approach to the right to erasure: more than just hitting delete
9 min read · May 14, 2026
Key concepts for understanding Law 21.719 on personal data protection
11 min read · Jan 26, 2026
How my digital identity was stolen (and what you can do to avoid it)
4 min read · Jan 18, 2025Frequently asked questions
Law 21.719 grounds the exercise of rights in the principle of transparency: data subjects must be able to understand what happens with their request. These are the questions that come up before implementing the module. If yours isn't here, write to us.
It's the module where requests people make about their personal data are received, handled, and resolved. Data subjects see a form and status tracking inside the privacy center embedded on your site; your internal team sees the full case in the dashboard. It's used by the teams responsible for responding: privacy, compliance, legal and, in many cases, customer service.
A channel for receiving requests, a response within the legal deadline, and the ability to prove how each case was resolved. The recognized rights are access, rectification, erasure, objection, and portability, plus temporary restriction of processing while a request is being resolved. Restriction has a shorter response deadline than the others.
Soyio operates under ISO 27001 and ISO 27701 certification. In the dashboard, permissions let a person manage cases without seeing the associated personal data, so day-to-day work doesn't expose information that role doesn't need.
It depends on where the form is published and whether your organization wants identity verification. An implementation with the public portal and the dashboard takes weeks. Automated flows into internal systems are added later, as your team defines its process.
Not to receive and respond to requests. To build workflows that query other systems, it helps to have someone who knows your internal architecture. The Soyio team works with you on flow design during the first weeks.
The portal is embedded on your site with the Soyio Web SDK, and identity verification is built into that same component. Toward internal systems, the module connects through APIs and webhooks, and workflows can call an external service or ask a person for approval by email. The case stays centralized in Soyio, even when part of the work happens in other tools.
Get intake in order before the first request arrives.
Rights Manager receives the request, verifies who is making it, and keeps a record of how it was resolved.
Book a demoSubscribe to our newsletter
Privacy is making headlines
A weekly roundup of privacy, regulation, and technology news that could affect your business.
Subscribe (LinkedIn, opens in a new tab)