WorkflowEU

EU GDPR DSAR Workflow

A defensible DSAR workflow depends on identity checks, complete search scope, and disciplined timekeeping.

Use Articles 12 to 22 and the EDPB access guidance to separate what must be returned from what may be withheld or redacted.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

DSAR compliance is not just about the right of access. It is a rights workflow that has to handle access, rectification, erasure, restriction, portability, objection, and automated-decision information without losing track of deadlines or over-disclosing third-party data. The operational baseline is one month to respond, with a possible two-month extension for complexity or volume, but the extension has to be justified and communicated within the first month.

Section 1

1) Intake, triage, and request normalization

Rights requests often arrive through support, privacy inboxes, product UIs, or legal contacts. Normalization prevents requests from disappearing into the wrong queue.

One request can trigger multiple GDPR rights at once, so the intake form should not force a single-label view.

Assign one request ID and log the request date, channel, and requested rights.
Normalize the request into access, deletion, rectification, portability, objection, restriction, or automated-decision information.
Log whether the request concerns the data subject directly, a parent, a legal representative, or another authorised party.
Trigger a deadline clock immediately and track any pause caused by identity clarification separately from the main compliance record.

Section 2

2) Identity verification and scope control

The controller must verify identity where it has reasonable doubts, but cannot routinely demand excessive proof.

The verification rule should match the risk of the data that will be disclosed or altered.

Use authenticated-account evidence where possible, and add stronger checks for raw exports or sensitive data.
Document the reason for any additional information requested under Article 12(6).
Maintain a search map showing which systems, logs, warehouses, and processors fall within the scope for each data subject identifier.
Record any limitations, such as archived systems or legal-hold constraints, and how they affected the response.

Recommended next step

Use EU GDPR DSAR Workflow as a cited research workflow

Research Copilot can take EU GDPR DSAR Workflow from clarifying scope and applicability with cited answers to a reusable workflow inside Sorena. Teams working on EU GDPR can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Research workflow

Open Research Copilot for EU GDPR DSAR Workflow

Start from EU GDPR DSAR Workflow and answer scope, timing, and interpretation questions with cited outputs.

Explore next step

Talk to Sorena

Talk through EU GDPR

Review your current process, evidence gaps, and next steps for EU GDPR DSAR Workflow.

Explore next step

Section 3

3) Response packaging by right

Rights responses should be templated but not mechanical. The response pack has to match the legal right invoked and the actual processing context.

Article 15 access requests are the most common, but they are not the only workflow to design.

For access, provide the data plus the Article 15 information set in a clear and intelligible format.
For rectification and erasure, confirm what was changed, what remains, and why anything was retained.
For portability, limit the output to data provided by the data subject and processed by automated means on the relevant legal basis.
For objection and restriction, document how systems and downstream processors will implement the request going forward.

Section 4

4) Extensions, refusals, and third-party rights

The highest-friction DSAR cases are usually complex, repetitive, or intertwined with the rights of other people.

You need rules for when to extend, narrow, redact, or refuse.

Use the two-month extension only where the complexity or number of requests justifies it, and notify the data subject within the initial month.
Document any reliance on manifestly unfounded or manifestly excessive grounds and route it through legal approval.
Protect the rights and freedoms of other individuals through redaction or withholding where necessary.
Keep an exceptions log so repeated edge cases can be reviewed and improved instead of re-litigated each time.

Primary sources