Artifact GuideEU GDPR

GDPR DSAR Workflow Data Subject Rights Intake, Response, and Evidence

Use this workflow to triage a GDPR rights request, confirm identity only where needed, define the request scope, run the one-month response clock, and record the response or refusal basis.

Built for privacy, support, legal, security, product, HR, data governance, and processor-management teams that need one operating record for Article 12, Article 15, and Article 28 handoffs.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

A GDPR data subject access request should move through one controlled record: capture the request, confirm the requester and relevant data subject, classify the right being exercised, preserve the one-month response clock, gather controller and processor evidence, and close with the response, extension notice, or reasoned refusal. The workflow below focuses on EU GDPR Articles 12, 15, 24, and 28 without adding country-specific derogations or authority-specific procedures.

Section 1

Open the DSAR record at intake

Treat every rights request as a time-sensitive controller workflow, even when it arrives through support, sales, HR, security, privacy, or a supplier mailbox. Article 12 requires the controller to facilitate rights under Articles 15 to 22 and to communicate in a concise, transparent, intelligible, and easily accessible form.

The intake record should separate the requester's words from the team's interpretation. Capture what was requested, when it was received, which channel received it, which data subject it appears to concern, and which products, accounts, employee records, systems, vendors, or countries may hold responsive data.

Create one DSAR case ID, receipt timestamp, requester contact, intake channel, accountable controller owner, and backup reviewer.
Classify the right requested: access, rectification, erasure, restriction, portability, objection, automated-decision review, or a mixed request requiring more than one response path.
Preserve the original request text and any attachments, then record the team's scope interpretation separately.
Start with the one-month response deadline from receipt, then update the record only if a grounded extension, refusal, or identity-check pause is justified by the facts.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12 sets the communication, facilitation, and one-month response framework for GDPR rights requests.

Section 2

Confirm identity and request scope before collecting data

Identity checks should be targeted. Article 12 allows additional information where the controller has reasonable doubts about the identity of the person making the request, but the workflow should avoid collecting extra identity data by default.

Scope the request before extracting records. For an access request, Article 15 covers confirmation whether personal data is processed, access to that data, specified processing information, transfer safeguards where relevant, and a copy of personal data undergoing processing. If the request is broader or unclear, record the likely rights involved and the systems to search.

Identity check: record why identity is already confirmed or why additional information is necessary and proportionate for this request.
Data-subject match: link the request to account IDs, employee IDs, customer records, device IDs, email addresses, or other identifiers already held by the controller.
Scope map: list the products, systems, repositories, vendors, retention locations, and business owners that may contain personal data for the data subject.
Access package: prepare the Article 15 elements separately from private working notes, legal analysis, third-party data, and security-sensitive material that may need review before disclosure.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12(6) supports targeted identity confirmation, and Article 15 defines the core access response elements.

Section 3

Run the one-month clock and document extensions or refusals

The default rule is response without undue delay and in any event within one month of receipt. Article 12 allows a two-month extension where necessary because of request complexity or number, but the data subject must be told within one month of receipt and given the reasons for the delay.

Refusals and fees are narrow paths, not routine workload controls. Article 12 allows a reasonable fee or refusal where a request is manifestly unfounded or excessive, especially because of repetitive character, and the controller bears the burden of demonstrating that character. If no action is taken, the controller must explain the reasons and the possibility of complaint and judicial remedy within one month.

Clock record: receipt date, default due date, response owner, reviewer, and any date the data subject was asked for necessary identity information.
Extension record: complexity or number of requests, reason for delay, date extension notice was sent, and revised internal target date.
No-action record: factual basis for not acting, legal review, notice to the data subject, complaint and judicial-remedy language, and approval owner.
Fee record: why the request is excessive or manifestly unfounded, administrative-cost basis, data-subject communication, and alternative response options considered.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12(3) through 12(6) sets the one-month response rule, two-month extension conditions, refusal notice duty, fee/refusal standard, and identity-check rule.

Section 4

Coordinate rights handling across controllers, processors, and internal owners

The controller owns the response, but processors may hold the data, logs, exports, deletion tooling, or account state needed to answer the request. Article 28 requires processor terms to include assistance, by appropriate technical and organisational measures where possible, for the controller's obligation to respond to Chapter III data-subject rights.

Make the processor handoff operational before a live request arrives. The DSAR runbook should specify vendor contacts, evidence formats, secure transfer method, escalation time, deletion or return limits, and how the controller reviews processor-provided data before sending anything to the data subject.

Controller owner: approves request scope, response position, extension, refusal, fee, and final response package.
System owner: exports responsive personal data, confirms retention state, and flags data that belongs to another person or requires review before disclosure.
Processor owner: sends documented instructions to suppliers, tracks supplier response dates, and confirms Article 28 assistance obligations are available.
Security or legal reviewer: checks delivery channel, redactions, third-party rights and freedoms, confidentiality constraints, and high-risk disclosure issues.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 24 supports accountable controller measures, and Article 28 requires processor assistance for responding to Chapter III data-subject rights.

Section 5

Close with a response package and reusable evidence file

Close the DSAR only when the response and evidence file tell the same story. For an access request, the response should address confirmation, access to personal data, Article 15 processing information, copy format where applicable, transfer safeguards where relevant, and any lawful limits applied.

Keep evidence for the handling of the request separately from the personal-data export. The evidence file should prove the controller met the response workflow, while the export or response content should be limited to what is appropriate for the data subject.

Response evidence: final response text, delivery date, delivery channel, language or accessibility considerations, reviewer approval, and any secure-transfer proof.
Search evidence: systems searched, owners contacted, processor requests, export dates, no-data findings, retention constraints, and quality checks.
Decision evidence: identity-check rationale, scope decisions, extension notice, refusal or fee basis, redaction rationale, and Article 15 response checklist.
Reopening triggers: duplicate or follow-up request, missed system, late processor response, correction from the data subject, new account identifier, or complaint escalation.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 12 and 15 define response content, format expectations, timing, and the controller's access-response duties.

Recommended next step

Use this guide to operationalize DSAR handling

Sorena can help convert your GDPR rights-request intake, processor escalation, response review, and evidence retention steps into a repeatable workflow tied to Article 12, Article 15, and Article 28.

Research workflow

Open Research Copilot for EU GDPR

Ask source-linked questions about DSAR intake, identity checks, response clocks, extensions, refusals, and processor assistance using the cited sources on this page.

Explore next step

Talk to Sorena

Talk through DSAR operations

Review your GDPR rights-request workflow, processor handoffs, evidence file, and response bottlenecks with Sorena.

Explore next step

Primary sources