Data Subject Rights Request Process

What it is

The notice establishes a Privacy Request Portal as the designated mechanism for submitting data subject rights requests including access, deletion, correction, and export, and states that identity verification is required for all requests, with account login accepted as verification for registered users.

Why it matters (compliance & governance perspective)

This provision establishes the operational procedure for exercising data subject rights under GDPR, UK GDPR, CCPA, and applicable state privacy laws, including the identity verification standard and authorized agent process. The requirement to provide additional verification for non-account holders may affect the ease of exercising rights for individuals who receive documents through DocuSign without having a registered account.

Clause Stability Stable

Consumer impact (what this means for users)

Under this provision, individuals can submit rights requests including deletion, correction, access, and data export through the DocuSign Privacy Request Portal, with identity verification required as a condition of processing. Authorized agents may submit requests on behalf of individuals subject to verification of the agent's authority.

What you can do

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: This provision engages GDPR Articles 15 through 22 data subject rights, UK GDPR equivalent provisions, and CCPA Sections 1798.100 through 1798.125. The authorized agent mechanism reflects CCPA requirements. GDPR imposes response time obligations (generally 30 days, extendable by two months) that are not specified in the notice text itself. 2. GOVERNANCE EXPOSURE: Medium. The notice directs all rights requests to the Privacy Request Portal, which is consistent with industry practice. However, the notice separately states that where DocuSign acts as a processor, rights requests will be forwarded to the relevant customer, which may extend response timelines and create accountability gaps if not addressed in data processing agreements. 3. JURISDICTION FLAGS: EU/EEA and UK users have mandatory rights under GDPR and UK GDPR with specific response time requirements. California residents have CCPA rights including the right to appeal a denied request, which the notice acknowledges. Other state privacy law jurisdictions may impose additional rights or response obligations. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers whose employees or transaction counterparties submit rights requests to DocuSign should ensure their data processing agreements specify how DocuSign will forward and coordinate processor-context rights requests. The notice states that DocuSign will forward processor-context requests to the relevant customer, but does not specify a timeline for doing so. 5. COMPLIANCE CONSIDERATIONS: Legal teams should review whether the Privacy Request Portal's identity verification process satisfies GDPR and CCPA requirements for verifiable consumer requests without being unduly burdensome. The appeal process referenced in the notice should be documented internally for California and other state privacy law compliance.

Applicable agencies

Provision details

Other risks in this policy

• Automatic Collection of Device Data medium
• Disclosure to Joint Marketing Partners medium
• AI Model Training Using De-Identified Customer Data With Consent high
• Binding Corporate Rules Govern EEA Data Transfers high
• Docusign Not Responsible for Third-Party Integration Data Use high
• Employer Organization Account Control Over Employee Accounts high