Appeals
An appeal lets a data subject ask you to look again at a decision on their request. Some privacy laws, mainly US state laws, oblige you to offer this. CookieHub shows the data subject the appeal option on their request page when the law that applies to the request requires it, tracks the appeal in the Dashboard, and sends the emails at each step.
Appeals are handled by account owners and DSAR handlers, on the same request detail page as the request itself.
When an appeal is offered
Each request has a jurisdiction. Until you confirm one on the request page, CookieHub suggests it from the data subject's country: GDPR for the EU, EEA, UK and Switzerland, "United States (state not identified)" for the US, and "Other" for everything else. The jurisdiction decides the response deadline, the extension, whether an appeal is offered, and how long you have to answer one.
| Jurisdiction | Appeal offered | Time to respond to an appeal |
|---|---|---|
| GDPR (EU, EEA, UK, Switzerland) | No | |
| California (CCPA/CPRA) | No | |
| Oklahoma | Yes | 60 days |
| Louisiana | Yes | 60 days |
| Alabama | No | |
| United States, state not identified | Yes | 45 days |
| Other / unspecified | No |
Where no appeal is offered and a regulator is configured for the jurisdiction, a rejected data subject is told they may complain to that authority instead.
For a jurisdiction that offers appeals, the data subject can lodge one when all of these are true:
- The request is rejected, or completed (a completed request can be appealed in these jurisdictions as well).
- Their email address has been verified (both parties, for an on-behalf request).
- They have no appeal open for it.
- They have not already appealed this decision. There is one appeal per decision. If you reopen the request and decide it again, a new appeal is possible.
What the data subject sees
On their request page the data subject finds an appeal section with a text box for their reasons (up to 5,000 characters). The section states how many days you have to respond, where the law sets that. Submitting it:
- Creates the appeal with the status Appeal submitted and records the decision that is being appealed, so that reopening the request later cannot change what was appealed.
- Sends the data subject (and the requester, for an on-behalf request) a confirmation email.
- Emails the account's owners that an appeal arrived.
The request page then shows the appeal's status, the date it was submitted, and the date you must respond by. After a decision it shows your written explanation, any action you took, and, for a denial, how to complain to the regulator.
If you ask for more information, the data subject replies from the same page. The reply can include one file (PDF, PNG or JPEG, up to the maximum upload size) and is encrypted before storage.
What you do
An appeal appears on the request detail page. A banner at the top shows that an appeal is open and when your response is due, and an Appeals card lists each appeal with the data subject's grounds, any messages exchanged, and the actions available.
Appeal statuses are:
| Status | Meaning |
|---|---|
| Appeal submitted | Waiting for you to start. |
| Under review | You started the review, or the data subject replied to your question. |
| Additional information requested | Waiting for the data subject to reply. |
| Approved | The original decision is reversed. |
| Partially approved | Part of the original decision is reversed. |
| Denied | The original decision stands. |
| Completed | You have carried out what an approved or partially approved appeal required. |
The actions are:
- Start review moves a submitted appeal to under review.
- Request information asks the data subject for something. You write what you need and why (up to 2,000 characters each; the reason is shown to the data subject). They are emailed a link to their request page. The response deadline keeps running while you wait.
- Decide appeal records the decision (approved, partially approved or denied) with a written explanation of up to 5,000 characters, which is sent to the data subject. For an approved or partially approved appeal you must also describe the action you took after reconsidering. Click Record decision & notify subject to send it.
- Reopen request to act, shown after an approved or partially approved decision, reopens the rejected or completed request so you can carry out the change. See Reopen request.
- Mark appeal completed closes an approved or partially approved appeal once the action is done.
Only an approved or partially approved appeal can be marked completed. A decision can be recorded only on an appeal that is still open.
Denying an appeal
When you deny an appeal and the jurisdiction has a regulator configured, the decision email tells the data subject they may complain to that authority and links to it, and a log entry records that this was sent. For Oklahoma the email also carries the wording the law requires. Files the data subject attached to the appeal are deleted when you record any decision.
Deadlines and reminders
The appeal's due date is the submission date plus the days in the table above. Where the jurisdiction sets none, the appeal has no due date. For appeals that have one, account owners receive reminder emails 7, 3 and 1 days before it. Every step you take is written to the request's audit log and instruction log.