# Duplicate DSR detection

Fides can automatically detect and suppress duplicate Data Subject Requests (DSRs). When enabled, any new privacy request that matches an existing one — same identity, same request type, within a configured time window — is automatically labeled **Duplicate** and skipped without processing.

You can also enable **auto-denial**, which automatically denies detected duplicates and notifies the data subject — removing the need to review and close each duplicate by hand.

Duplicate detection applies to **access and erasure** requests only. Consent requests are excluded.

## How duplicate detection works

When a new privacy request is received, Fides checks for existing requests that match on the configured criteria. Matching is always scoped to a single **policy** — only requests submitted under the same policy are compared, so different request types such as access vs. erasure are always treated separately. Within that scope, Fides compares:

- **Identity fields** — by default, the requester's email address. Can be extended to include additional fields such as phone number.
- **Time window** — only requests submitted within the configured lookback period are considered (default: 365 days).
- **Location/jurisdiction** _(optional, on by default)_ — when enabled, only requests with the **same** location/jurisdiction are considered duplicates.
- **Property** _(optional)_ — when enabled, only requests submitted against the same property are considered duplicates.
- **Custom fields** _(optional)_ — when enabled, matches are further narrowed to requests with matching values for the specified custom privacy request fields.

Fides combines all active criteria with **AND** logic — a request must match on every enabled criterion to be flagged as a duplicate.

### Priority rules for canonical requests

If a match is found, Fides groups the requests together and then applies the following priority rules to decide which request is the **canonical** (authoritative) one:

| Priority | Condition | Outcome |
| :-- | :-- | :-- |
| 1 | An existing request in the group is already **actioned** (approved, in processing, etc.) | New request is marked **Duplicate** |
| 2 | An existing request in the group has a **verified identity** and this request does not | New request is marked **Duplicate** |
| 3 | This request is the **first to have its identity verified** | This request is canonical and will not be marked as a duplicate; other unverified requests are marked **Duplicate** |
| 4 | No requests have verified identities — the **oldest request** in the group is canonical | Newer matching requests are marked **Duplicate** |

Fides matches only against **non-terminal** requests.

### Automatically denying duplicates

By default, Fides flags duplicates with a **Duplicate** status and leaves them for an administrator to review. With **auto-denial** enabled, Fides goes one step further and automatically moves each detected duplicate to a **Denied** status without any manual action.

When auto-denial is enabled and a request is detected as a duplicate:
1. Fides transitions the request from **Duplicate** to **Denied** automatically.
2. Fides records the denial for audit purposes.

### Audit trail for auto-denied requests

Every auto-denial is fully auditable:
- The **activity timeline** records a **Duplicate Request Detection** event log entry identifying the canonical request the duplicate matched against.
- The request's **audit log** records the denial action, including the denial reason.

## Configuring duplicate detection

Duplicate detection is **disabled by default**. To configure it:
1. Navigate to **Settings** → **DSR configuration**
2. Toggle **Enable duplicate detection** on
3. Configure the matching criteria and options.
4. Click **Save**

The available settings are:
| Setting | Description |
| :-- | :-- |
| **Enable duplicate detection** | Turns duplicate detection on or off. |
| **Duplicate detection window (days)** | The number of days to look back when comparing requests. |
| **Identity fields to match** | The identity fields used for matching. |
| **Match location/jurisdiction** | When on, only requests with the same location/jurisdiction are considered duplicates. |
| **Match property ID** | When on, only requests with the same property ID are considered duplicates. |
| **Custom fields to match** | Additional custom privacy request field labels that further narrow matches. |
| **Automatically deny duplicates** | When on, detected duplicates are automatically denied. |
| **Denial reason** | The message sent to the data subject when a duplicate is auto-denied. |

### Workflow for handling duplicates

How you handle duplicates depends on whether auto-denial is enabled.
- **With auto-denial enabled**, duplicates are denied automatically and the data subject is notified.
- **With auto-denial disabled**, duplicates are flagged with a **Duplicate** status and left for review.

### Other handling options
- **Leave them** — Duplicates are already suppressed from processing.
- **Check the canonical request** — Use the ID from the duplicate's events log to find the related canonical request and verify it is progressing correctly.
- **Re-evaluate configuration** — If legitimate requests are being incorrectly flagged, consider adjusting the time window or matching criteria.