GDPR Data Subject Access Request (DSAR)

Tasks in this template

1. 1
   Acknowledge receipt of the DSAR in writing TODAY

   Article 12(3): respond without undue delay and at the latest within one month. Acknowledge receipt on day 0 to start the clock explicitly.

2. 2
   Verify the requester's identity D+1

   Article 12(6): request additional information where there are reasonable doubts about identity. Do not release data before verification.

3. 3
   Log the request in the DSAR register D+2
4. 4
   Determine the scope of personal data held about the requester D+3

   Search all controlled systems: CRM, HR, marketing, support, backups within retention, processor systems. Coordinate with IT and system owners.

5. 5
   Consult IT on technical data retrieval D+5
6. 6
   Check third-party and other data subjects' rights before disclosure D+7

   Article 15(4): the right to obtain a copy must not adversely affect the rights and freedoms of others. Redact third-party personal data where necessary.

7. 7
   Redact third-party personal data from the response package D+10
8. 8
   Compile the response: data, categories, recipients, retention, sources, rights D+14

   Article 15(1)(a)–(h): include purposes of processing, categories of data, recipients, retention period, existence of rights, source if not collected from the subject, automated decision-making logic.

9. 9
   Submit the draft response for legal review D+18
10. 10
    Quality check: completeness, redactions, format accessibility D+21
11. 11
    Send the response via a secure channel D+25

    Article 12(3): must be delivered within one month of receipt. Use encrypted email, secure portal, or registered post per requester's preference.

12. 12
    Update the Article 30 records of processing activities D+26

    Document the request and response in the RoPA for audit and accountability (Art. 5(2), 30).

13. 13
    Archive evidence of the request, response, and delivery proof D+27
14. 14
    Close the request and capture lessons learned D+28