Power Automate workflow · Compliance

PDPA data access and correction requests with the 21-day clock

Log access and correction requests, track the statutory deadline, and assemble a redacted response pack.

TriggerMicrosoft Forms (public request form) or a dedicated mailbox
ConnectorsMicrosoft Forms · SharePoint · Planner · Adobe PDF Services
CategoryCompliance

The problem

Access requests arrive by email and get lost; responses miss the deadline.

The outcome

Every request is logged with its due date, owners are reminded, and the response is a redacted, protected PDF.

Before you start

  • A DSAR list with Received Date, Due Date, Status, Owner.

Build it step by step

  1. Log — Create the request with Due Date = received + 21 days (PDPA's response period for access requests).
    Expression / setting
    addDays(utcNow(), 21)
  2. Verify identity — Assign a task to verify the requester's identity before any data is gathered.
  3. Gather — Owners upload relevant records to the request folder.
  4. Redact and compile — Redact third-party data in Acrobat Pro, then merge and protect the pack.
  5. Respond and close — Send the pack and record the response date; reminders fire at day 14 and day 19.

Connector action names are shown as they appear in Power Automate at the time of writing; Microsoft and Adobe occasionally rename actions or add new versions.

Error handling

  • Confirm current deadlines and fee rules with your legal team — the PDPA was amended in 2024.

Licensing

  • Standard connectors + Adobe PDF Services; Acrobat Pro for redactors.

Variations

  • Add correction requests with a separate 21-day clock and an audit of what was changed.

Common in: Healthcare · Banking · Insurance · Retail