Who fulfills a data subject access or deletion request, and which department is accountable if the deadline is missed?

Data subject access and deletion requests are rarely handled by one person. Fulfillment is a coordinated workflow, while accountability for meeting the deadline rests with a designated owner. Confusing the two is the most common reason requests are missed.

Who actually fulfills the request

Several roles touch a request before it is complete:

• Intake/privacy office — receives the request, verifies the requester’s identity, and logs the clock start. In government, this often parallels the Privacy Act request process.
• Records and IT teams — perform the actual search across systems, applications, and backups to locate the relevant personal data.
• Business/data owners — confirm what may be disclosed, redacted, or deleted, and flag any legal hold or retention requirement that blocks deletion.
• Legal/compliance — reviews exemptions, applicable retention obligations, and the final response.

Deletion adds a wrinkle: data under a litigation hold or a mandatory retention schedule generally cannot be erased until that obligation lapses. Fulfillment teams must reconcile the individual’s request with those duties before acting.

Who is accountable for the deadline

Fulfillment is shared, but accountability should be assigned to a single owner — typically a privacy officer, data protection officer (DPO), or designated records/compliance lead. That role:

• Tracks the statutory or policy clock from the verified request date.
• Coordinates the contributing teams and escalates bottlenecks.
• Approves any permitted extension and documents the justification.

If the deadline is missed, accountability falls to that designated owner and, ultimately, the organization itself — not the individual analyst who ran a search. Regulators and courts look at whether the organization had a defined process, clear ownership, and a defensible record of its actions.

Make it defensible

The practical safeguards are governance, not heroics:

1. A written procedure naming the accountable owner and each contributing role.
2. A tracking log with dates, decisions, and extension rationale.
3. Retention schedules and hold rules referenced before any deletion.

For related guidance, see the privacy and PII topic hub.

A clear RACI — who does the work, who is accountable, who must be consulted — turns a scramble into a repeatable, auditable response.