The prompt
Score 10 of 10, Excellent
Use it when You need a response that acknowledges a privacy request, sets the timeline and asks for what you need.
- {{sender}}
- {{organization}}
- {{request_type}}
- {{date_received}}
- {{request_text}}
- {{procedure}}
- {{deadline}}
- {{verification}}
- {{reference}}
Full prompt and why it works
Prompt
Draft a reply to the personal data request below, for {{sender}} at {{organization}} to review and send. The person has asked us to {{request_type}}. The reply should acknowledge the request, say what happens next and by when, and ask for anything we need before we can act. The request, exactly as received on {{date_received}}: """ {{request_text}} """ Our procedure for these requests, with section numbers: """ {{procedure}} """ Our response deadline, as set by our procedure or counsel: {{deadline}} What we need to verify identity: {{verification}} Reference number: {{reference}} Write the email in plain, polite language, 120 to 220 words, with a subject line that includes the reference number if there is one. In this order: 1. Thank them and confirm the date we received the request. 2. Restate what they asked for, in their terms, so they can correct us if we misread it. 3. Say what we need from them, exactly as our verification requirements list it, and how to send it securely. 4. Say when they will hear from us, using the deadline above exactly. 5. Give a contact for questions. Do not confirm or deny that we hold any data about them, and do not include any personal data in the reply, because we have not yet verified who they are. Do not promise to delete or send everything, ask for more identification than our procedure lists, mention fees, or name laws and rights unless our procedure names them (and then quote it exactly). The reply should read as if a careful person handled it: specific, calm and not defensive. For example, "We received your request on [date] and will reply by [date]" works better than "We will process your request in due course". After the email, add "For the privacy lead": - The procedure section each part of the reply relies on, quoted with its number. - Anything unclear, such as a request sent on someone else's behalf, one that covers several accounts, or a deadline that does not match the procedure. Do not guess; flag it. - Take to a qualified lawyer: specific questions, such as whether any data has to be kept despite a deletion request.
Variables
- {{sender}}
- Who signs the reply, with their role, for example "the privacy team".
- {{organization}}
- Your organization's name.
- {{request_type}}
- What they asked for, for example "send a copy of their personal data" or "delete their account data".
- {{date_received}}
- The date the request arrived.
- {{request_text}}
- The request exactly as received, by email, form or letter.
- {{procedure}}
- Your internal procedure or privacy policy section for these requests, with section numbers.
- {{deadline}}
- The reply date your procedure or counsel sets, as a date, for example "by June 30".
- {{verification}}
- What you need to confirm identity, as your procedure lists it, for example "reply from the email address on the account".
- {{reference}}
- Your case or ticket number, or "none".
Why it works
- What to avoid. The reply confirms nothing about the person's data and includes none of it until identity is verified, which protects them if the request is not genuine.
- Background facts. The deadline and identity checks come from your own procedure, so the reply never quotes a timeline or a right your privacy lead has not set.
- If unsure. Requests made for someone else, or that span several accounts, are flagged for the privacy lead rather than answered on a guess.