Artifact GuideEU GDPR

GDPR DSAR Workflow Data Subject Rights Intake, Response, and Evidence

This workflow helps triage a GDPR rights request, confirm identity only where needed, define the request scope, run the one-month response clock, and record the response or refusal basis.

Built for privacy, support, legal, security, product, HR, data governance, and processor-management teams that need one operating record for Article 12, Article 15, and Article 28 handoffs.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

A GDPR should move through one controlled record: preserve the request, confirm the requester and relevant data subject, classify every right being exercised, protect the one-month response period, gather controller evidence and processor assistance, and close with the action taken, extension notice, or reasoned no-action decision. A request may be called manifestly unfounded or excessive only on documented case-specific facts. This workflow covers EU GDPR Articles 12 and 15 to 22, with the supporting accountability and processor duties in Articles 24 and 28, without adding country-specific derogations or authority procedures.

Section 1

Open the DSAR record at intake

Treat every rights request as a time-sensitive controller workflow, even when it arrives through support, sales, HR, security, privacy, or a supplier mailbox. Article 12 requires the controller to help people exercise rights under Articles 15 to 22 and to communicate in a concise, transparent, intelligible, and easily accessible form.

The intake record should separate the requester's words from the team's interpretation. Capture what was requested, when it was received, which channel received it, which data subject it appears to concern, and which products, accounts, employee records, systems, vendors, or countries may hold responsive data.

Create one DSAR case ID, receipt timestamp, requester contact, intake channel, accountable controller owner, and backup reviewer.
Classify the right requested: access, rectification, erasure, restriction, portability, objection, automated-decision review, or a mixed request requiring more than one response path.
Preserve the original request text and any attachments, then record the team's scope interpretation separately.
Start with the one-month response deadline from the time the request reaches an official controller channel; do not wait for privacy staff to open the ticket.
Record a two-month extension, refusal, or any EDPB-guidance suspension for necessary identity information or qualifying scope clarification only when the case-specific conditions and communication dates are documented.
Accept plain-language requests without requiring the requester to cite the GDPR or use a designated form; route requests received through other official channels into the same controlled record.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12 sets the communication, facilitation, and one-month response framework for GDPR rights requests.

Section 2

Confirm identity and request scope before collecting data

Identity checks should be targeted. Article 12 allows additional information where the controller has reasonable doubts about the identity of the person making the request, but the workflow should avoid collecting extra identity data by default.

Scope the request before extracting records. For an access request, Article 15 covers confirmation whether personal data is processed, access to that data, specified processing information, transfer safeguards where relevant, and a copy of personal data undergoing processing. The right is to a faithful and intelligible reproduction of the personal data, not automatically to every original document containing it; extracts or whole documents may be necessary where essential to make the data intelligible. If the request is broader or unclear, record the likely rights involved and the systems to search.

Identity check: record why identity is already confirmed or why additional information is necessary and proportionate for this request.
Representative check: where another person acts for the data subject, verify the representative's identity and authority without demanding broader personal data than the disclosure or action risk requires.
Data-subject match: link the request to account IDs, employee IDs, customer records, device IDs, email addresses, or other identifiers already held by the controller.
Scope map: list the products, systems, repositories, vendors, retention locations, and business owners that may contain personal data for the data subject.
Access package: prepare the Article 15 elements separately from unpublished working notes, legal analysis, third-party data, and security-sensitive material that may need review before disclosure.
Clarification record: if the controller processes a large quantity of information and asks the data subject to specify the information or processing activities sought, preserve the original scope and do not make access conditional on a new request.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12(6) supports targeted identity confirmation, and Article 15 defines the core access response elements.

EDPB Guidelines 01/2022 on data subject rights - right of access

Explains that the copy covers the personal data undergoing processing, not necessarily original documents, and that the format must make the data intelligible.

Section 3

Route each right to its own decision and action

Do not use an Article 15 access checklist as a substitute for the other Chapter III tests. Split a mixed request into linked work items, apply the conditions and limits of each right, and give the data subject one coherent response that identifies the action taken for each part.

Downstream work differs by right. Rectification, erasure, or restriction can trigger Article 19 communications to recipients unless that proves impossible or involves disproportionate effort, and the controller must tell the data subject about those recipients if requested. Portability does not erase the source data or displace other rights, while an objection can require processing to stop even though another lawful retention obligation remains.

Article 15 access: decide confirmation, the personal-data copy, the Article 15(1) and 15(2) information, and intelligible format. Name the actual recipients unless the data subject chooses recipient categories, the recipients cannot be identified, or the request is manifestly unfounded or excessive, and make any concrete Article 15(4) reconciliation.
Article 16 rectification: identify inaccurate data and any incomplete data that needs a supplementary statement, validate the correction, update authoritative records, and prevent stale replicas from overwriting it.
Articles 17 and 18 erasure or restriction: test the relevant statutory grounds and exceptions, record which data and processing are affected, preserve data that must be retained or restricted, and control restoration of restricted processing.
Article 19 recipient communication: identify recipients of data subject to rectification, erasure, or restriction, send the required communication unless impossible or disproportionate, record any exception, and be ready to identify recipients to the data subject on request.
Article 20 portability: confirm that processing is based on consent or contract and carried out by automated means, distinguish data provided by the data subject from derived analysis, use a structured, commonly used, machine-readable format, and transmit directly where technically feasible.
Article 21 objection: separate direct marketing, where the relevant personal-data processing must stop, from public-task or legitimate-interest processing, where the controller must assess compelling legitimate grounds or legal-claims needs.
Article 22 request: confirm whether a decision is based solely on automated processing and produces legal or similarly significant effects, then test the applicable exception and safeguards, including human intervention, the person's views, and contesting the decision.

Sources for this answer

Regulation (EU) 2016/679 (GDPR), Articles 15-22

Articles 15 to 22 define the separate access, rectification, erasure, restriction, notification, portability, objection, and automated-decision paths.

EDPB Guidelines 01/2022 on data subject rights - right of access

Explains the three components of access, actual-recipient information, intelligible copies, clarification, and reconciliation with others' rights.

Section 4

Run the one-month clock and document extensions or refusals

The default rule is response without undue delay and in any event within one month of receipt. Article 12 allows a two-month extension where necessary because of request complexity or number, but the data subject must be told within one month of receipt and given the reasons for the delay.

Refusals and fees are narrow paths, not routine workload controls. Article 12 allows a reasonable fee or refusal where a request is manifestly unfounded or excessive, especially because of repetitive character, and the controller bears the burden of demonstrating that character. If no action is taken, the controller must explain the reasons and the possibility of complaint and judicial remedy within one month.

Clock record: receipt date, default due date, response owner, reviewer, and any date the data subject was asked for necessary identity information.
Extension record: complexity or number of requests, reason for delay, date extension notice was sent, and revised internal target date.
No-action record: factual basis for not acting, legal review, notice to the data subject, complaint and judicial-remedy language, and approval owner.
Fee record: why the request is excessive or manifestly unfounded, administrative-cost basis, data-subject communication, and alternative response options considered.
Clock qualification: distinguish an Article 12 extension from any limited EDPB-guidance suspension; record the authority relied on and never pause the clock merely because an internal owner or processor is late.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12(3) through 12(6) sets the one-month response rule, two-month extension conditions, refusal notice duty, fee/refusal standard, and identity-check rule.

Section 5

Coordinate rights handling across controllers, processors, and internal owners

The controller owns the response, but processors may hold the data, logs, exports, deletion tooling, or account state needed to answer the request. Article 28 requires processor terms to include assistance, by appropriate technical and organisational measures where possible, for the controller's obligation to respond to Chapter III data-subject rights.

Make the processor handoff operational before a live request arrives. The DSAR runbook should specify vendor contacts, evidence formats, secure transfer method, escalation time, deletion or return limits, and how the controller reviews processor-provided data before sending anything to the data subject.

Controller owner: approves request scope, response position, extension, refusal, fee, and final response package.
System owner: exports responsive personal data, confirms retention state, and flags data that belongs to another person or requires review before disclosure.
Processor owner: sends documented instructions to suppliers, tracks supplier response dates, and confirms Article 28 assistance obligations are available.
Security or legal reviewer: checks delivery channel, redactions, third-party rights and freedoms, confidentiality constraints, and high-risk disclosure issues.
Rights-action owner: confirms that corrections, deletions, restrictions, objection outcomes, and automated-decision safeguards were applied in production systems rather than recorded only in the case ticket.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 24 supports accountable controller measures, and Article 28 requires processor assistance for responding to Chapter III data-subject rights.

Section 6

Close with a response package and reusable evidence file

Close the DSAR only when the response and evidence file tell the same story. For an access request, the response should address confirmation, access to personal data, Article 15 processing information, copy format where applicable, transfer safeguards where relevant, and any lawful limits applied.

Keep evidence for the handling of the request separately from the personal-data export. The evidence file should prove the controller met the response workflow, while the export or response content should be limited to what is appropriate for the data subject. Article 15(4) protects the rights and freedoms of others, but it is not a reason to reject the entire request where redaction, partial disclosure, or another measure can provide access without harming those rights.

Response evidence: final response text, delivery date, delivery channel, language or accessibility considerations, reviewer approval, and any secure-transfer proof.
Search evidence: systems searched, owners contacted, processor requests, export dates, no-data findings, retention constraints, and quality checks.
Decision evidence: identity-check rationale, scope decisions, extension notice, refusal or fee basis, redaction rationale, and Article 15 response checklist.
Action evidence: before-and-after values or controlled confirmation for rectification, erasure, restriction, objection, portability, recipient communication, or human review, with exceptions and retained-data reasons.
Reopening triggers: duplicate or follow-up request, missed system, late processor response, correction from the data subject, new account identifier, or complaint escalation.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 12 and 15 define response content, format expectations, timing, and the controller's access-response duties.

EDPB Guidelines 01/2022 on data subject rights - right of access

Explains that Article 15(4) requires a concrete assessment and should lead to redaction or omission where possible, not automatic refusal of the whole request.

Recommended next step

This guide helps operationalize DSAR handling

Sorena can help convert your GDPR rights-request intake, processor escalation, response review, and evidence retention steps into a repeatable workflow tied to Article 12, Article 15, and Article 28.

Research workflow

Open Research Copilot for EU GDPR

Ask questions tied to cited sources about DSAR intake, identity checks, response clocks, extensions, refusals, and processor assistance using the cited sources on this page.

Explore next step

Talk to Sorena

Talk through DSAR operations

Review your GDPR rights-request workflow, processor handoffs, evidence file, and response bottlenecks with Sorena.

Explore next step

Primary sources

References and citations

EDPB Guidelines 01/2022 on data subject rights - right of access

edpb.europa.eu

Referenced sections

Explains that Article 15(4) requires a concrete assessment and should lead to redaction or omission where possible, not automatic refusal of the whole request.

Regulation (EU) 2016/679 (GDPR)

eur-lex.europa.eu

Referenced sections

Articles 12 and 15 define response content, format expectations, timing, and the controller's access-response duties.

"The controller shall provide a copy"

Regulation (EU) 2016/679 (GDPR), Articles 15-22

eur-lex.europa.eu

Referenced sections

Articles 15 to 22 define the separate access, rectification, erasure, restriction, notification, portability, objection, and automated-decision paths.