Data subject rights: what customers can ask for

UK GDPR gives people rights over their personal data. For a business using an AI receptionist, requests are rare but real — and easy to handle when you know what's coming.

The rights, in plain terms

• Access (DSAR/SAR) — "give me a copy of everything you hold on me." The most common request.
• Erasure ("right to be forgotten") — "delete my data." Subject to exceptions (legal obligations, active contracts).
• Rectification — "fix my details."
• Restriction — "stop processing while we sort this out."
• Objection — "stop processing for that purpose" (esp. marketing).
• Portability — "give me my data in a usable format."
• Automated decision-making — rights where decisions about them are fully automated (mostly N/A here — the assistant books appointments, it doesn't adjudicate).

What a request looks like in practice

Caller emails: "I rang you in March — I want a copy of the recording and transcript, then I want it deleted."

Your obligations: respond within one calendar month, verify identity reasonably, provide the data (or delete it where required), and do it for free (unless manifestly unfounded/excessive).

How to handle one on Agentric

1. Find the contact — dashboard → search their number/email.
2. Export — transcripts, recordings, contact data export to a file.
3. Action — deletion request? Delete the record (recordings, transcripts, contact) — a deletion button exists precisely for this.
4. Log it — note the request and the action in your own records; our audit trail backs you up.
5. Respond — confirm to the person within the month.

Our Data Deletion page tells callers how to reach you — or us — and the tooling does the mechanics.

When you can say no (partially)

Erasure has limits: you can retain what's needed for a legal obligation (tax records), active contract, or legal claims. "Delete everything" doesn't override "I need the invoice record for HMRC."

The posture that works

Requests are rare and mostly genuine. The right response is unremarkable: verify identity lightly (they called you — confirm the number), action the request, respond clearly. Most requesters want exactly what they asked for, and the businesses that handle it matter-of-factly keep the trust.