Case Statuses

Cases move through different statuses as they’re processed. Understanding these statuses helps you manage your workflow efficiently.

Working Statuses

These statuses indicate active cases that require attention:

Opened

Initial status when a case is created.

Case has been received but not yet worked on
30-day deadline timer is running
Appears in “requires attention” counts

In Progress

Case is actively being worked on.

Documents are being gathered
Data is being compiled
Response is being prepared

Identity Verified

Subject’s identity has been confirmed.

Identity verification completed
Safe to proceed with providing personal data
Important step before disclosing sensitive information

Awaiting Information

Waiting for the data subject to provide additional information.

Clock may be paused (depending on jurisdiction)
Subject has been contacted
Case cannot proceed until response received

Information Received

Subject has responded with requested information.

New information received
Ready to continue processing
Review the submitted information

Deadline Extended

Deadline has been extended per GDPR Article 12.

Complex request requiring more time
Subject has been notified of extension
New deadline calculated (up to 2 additional months)

Closed Statuses

These statuses represent completed cases:

Completed & Fulfilled

Request was fully satisfied.

All requested data provided
Or all requested deletions completed
Subject has received response

Rejected

Request was lawfully denied.

Valid grounds for rejection exist
Subject notified of reasons
Legal basis documented

Rejection grounds include:

Manifestly unfounded request
Excessive/repetitive requests
Request affects rights of others
Legal exemptions apply

Withdrawn by Subject

Subject withdrew their request.

Subject cancelled the request
Written confirmation received
No further action required

No Data Found

No personal data found for the subject.

Search completed
No matching records exist
Subject informed of outcome

Duplicate Request

Request is a duplicate of another case.

Same subject, same request type
Previous case already handles this
Link to original case documented

Invalid Request

Request does not meet requirements.

Not a valid GDPR request
Subject not identifiable
Request outside scope

Status Workflow

Opened
  ↓
In Progress ←→ Awaiting Information → Information Received
  ↓                                      ↓
Identity Verified ←-----------------------
  ↓
Deadline Extended (if needed)
  ↓
[Closed Status]

Changing Status

From the Case Summary

Open the case
Use the Quick Actions buttons
Select the appropriate action
Confirm the status change

Available Transitions

From Status	Can Move To
Opened	In Progress, Awaiting Information, any Closed
In Progress	Identity Verified, Awaiting Information, Deadline Extended, any Closed
Awaiting Information	Information Received, any Closed
Information Received	In Progress, Identity Verified, any Closed
Identity Verified	Deadline Extended, any Closed
Deadline Extended	any Closed

Who can change status

Admins, Case Managers and Reviewers can change a case's working status and upload documents. However, only Admins and Case Managers can close or complete a case — Reviewers cannot close, complete, or submit information on a subject's behalf.

Status Best Practices

Verify Identity Before Disclosing Data

Always verify the subject’s identity before sharing personal data, especially for:

Access requests containing sensitive data
Requests received through non-verified channels
High-value or sensitive records

Click Mark Verified to set the case to Identity Verified — the method (Manual review, or Portal token for portal submissions) and a timestamp are recorded automatically. See Identity Verification.

Use Awaiting Information Appropriately

Only use this status when you’ve actually contacted the subject and are waiting for their response. Document what information was requested.

Document Closure Reasons

When closing a case, always:

Select the accurate closure status
Add closing notes explaining the outcome
Attach any final correspondence

After closure, cases and their documents are eventually purged automatically per your tenant’s configured retention period (set in Settings > Case Management, in months). Closed cases can also be anonymized to clear contact PII while preserving a compliance hash — see Case Actions.

Monitor Deadline-Extended Cases

Extended cases should be rare. If you’re extending frequently:

Review your processes for efficiency
Consider if you need more resources
Check if requests could be handled faster

Audit Trail

Every status change is recorded in the case timeline and audit log, including:

Who made the change
When it occurred
Previous and new status
Any notes added

This creates a complete compliance record for regulatory review.