Fides Documentation – Ethyca
Duplicate DSR detection
Fides can automatically detect and suppress duplicate Data Subject Requests (DSRs). When enabled, any new privacy request that matches an existing one — same identity, same request type, within a configured time window — is automatically labeled Duplicate and skipped without processing.
You can also enable auto-denial, which automatically denies detected duplicates and notifies the data subject — removing the need to review and close each duplicate by hand.
Duplicate detection applies to access and erasure requests only. Consent requests are excluded.
How duplicate detection works
When a new privacy request is received, Fides checks for existing requests that match on the configured criteria. Matching is always scoped to a single policy — only requests submitted under the same policy are compared, so different request types such as access vs. erasure are always treated separately. Within that scope, Fides compares:
- Identity fields — by default, the requester's email address. Can be extended to include additional fields such as phone number.
- Time window — only requests submitted within the configured lookback period are considered (default: 365 days).
- Location/jurisdiction (optional, on by default) — when enabled, only requests with the same location/jurisdiction are considered duplicates.
- Property (optional) — when enabled, only requests submitted against the same property are considered duplicates.
- Custom fields (optional) — when enabled, matches are further narrowed to requests with matching values for the specified custom privacy request fields.
Fides combines all active criteria with AND logic — a request must match on every enabled criterion to be flagged as a duplicate.
Priority rules for canonical requests
If a match is found, Fides groups the requests together and then applies the following priority rules to decide which request is the canonical (authoritative) one:
| Priority | Condition | Outcome |
|---|---|---|
| 1 | An existing request in the group is already actioned (approved, in processing, etc.) | New request is marked Duplicate |
| 2 | An existing request in the group has a verified identity and this request does not | New request is marked Duplicate |
| 3 | This request is the first to have its identity verified | This request is canonical and will not be marked as a duplicate; other unverified requests are marked Duplicate |
| 4 | No requests have verified identities — the oldest request in the group is canonical | Newer matching requests are marked Duplicate |
Fides matches only against non-terminal requests.
Automatically denying duplicates
By default, Fides flags duplicates with a Duplicate status and leaves them for an administrator to review. With auto-denial enabled, Fides goes one step further and automatically moves each detected duplicate to a Denied status without any manual action.
When auto-denial is enabled and a request is detected as a duplicate:
- Fides transitions the request from Duplicate to Denied automatically.
- Fides records the denial for audit purposes.
Audit trail for auto-denied requests
Every auto-denial is fully auditable:
- The activity timeline records a Duplicate Request Detection event log entry identifying the canonical request the duplicate matched against.
- The request's audit log records the denial action, including the denial reason.
Configuring duplicate detection
Duplicate detection is disabled by default. To configure it:
- Navigate to Settings → DSR configuration
- Toggle Enable duplicate detection on
- Configure the matching criteria and options.
- Click Save
The available settings are:
| Setting | Description |
|---|---|
| Enable duplicate detection | Turns duplicate detection on or off. |
| Duplicate detection window (days) | The number of days to look back when comparing requests. |
| Identity fields to match | The identity fields used for matching. |
| Match location/jurisdiction | When on, only requests with the same location/jurisdiction are considered duplicates. |
| Match property ID | When on, only requests with the same property ID are considered duplicates. |
| Custom fields to match | Additional custom privacy request field labels that further narrow matches. |
| Automatically deny duplicates | When on, detected duplicates are automatically denied. |
| Denial reason | The message sent to the data subject when a duplicate is auto-denied. |
Workflow for handling duplicates
How you handle duplicates depends on whether auto-denial is enabled.
- With auto-denial enabled, duplicates are denied automatically and the data subject is notified.
- With auto-denial disabled, duplicates are flagged with a Duplicate status and left for review.
Other handling options
- Leave them — Duplicates are already suppressed from processing.
- Check the canonical request — Use the ID from the duplicate's events log to find the related canonical request and verify it is progressing correctly.
- Re-evaluate configuration — If legitimate requests are being incorrectly flagged, consider adjusting the time window or matching criteria.