Artifact GuideEU GDPR

GDPR DSAR Workflow Intake, Clock, Rights, and Evidence

This workflow helps capture a data subject request, confirm identity only where justified, scope the right being exercised, run the one-month response clock, and close with a response, extension notice, refusal, or evidence-backed no-data outcome.

Built for privacy, legal, support, HR, product, security, data governance, and vendor-management teams that need one operating record for GDPR Chapter III rights.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

A GDPR workflow should preserve the original request, identify the data subject and controller role, use proportionate identity verification, route every right raised under Articles 15 to 22, and protect the Article 12 response deadline. For access, it should produce an intelligible access copy while reconciling the . The record must explain any extension, fee, refusal, processor handoff, negative search result, and final delivery.

Section 1

1. Open the DSAR intake record

Open one case record as soon as a request under GDPR data subject rights is received through privacy, support, sales, HR, security, product, or another official controller channel. Article 12 requires the controller to help people exercise their rights and to communicate in a concise, transparent, intelligible, and easily accessible form.

Keep the requester's original wording separate from the team's classification. A single message can combine access, erasure, objection, portability, correction, or automated-decision concerns, and the workflow should avoid narrowing the request before a reviewer has scoped it.

Capture case ID, receipt timestamp, intake channel, requester contact, apparent data subject, controller entity, accountable owner, reviewer, and default one-month due date.
Store the original request text, attachments, envelope metadata, language used, and any stated account, employee, device, transaction, or customer identifiers.
Classify the requested right or rights: access, rectification, erasure, restriction, portability, objection, automated-decision review, or mixed request.
Flag immediate handoffs: HR data, customer account data, child-related data, special category data, security logs, processor-held data, or data that may involve another person's rights and freedoms.
Treat a request as received when it reaches an official controller channel, even if the person did not use a privacy form, cite the GDPR, or send it directly to the privacy team.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12 requires the controller to help people exercise rights under Articles 15 to 22 and communicate about their requests.

Section 2

2. Confirm identity without over-collecting

Do not turn identity verification into a default document-collection step. Article 12 allows additional information where the controller has reasonable doubts about the identity of the person making the request, and Article 11 addresses situations where the controller cannot identify the data subject from the data it holds.

The workflow should record why identity is already reliable or why extra information is necessary. The extra information requested should be tied to the data at issue, the channel used, and the risk of disclosing or changing personal data for the wrong person.

Record existing identity signals such as authenticated session, verified email, employee account, customer ID, support history, signed channel, or prior verified relationship.
If identity is uncertain, ask only for additional information necessary to confirm the identity for this request and record the reason for asking.
For a representative, verify both the representative and the authority to act for the data subject; tailor the proof to the sensitivity and consequence of the requested disclosure or action.
If the controller cannot identify the data subject from available data, record the no-match result and what additional information would make identification possible.
Keep identity proof, verification notes, and access permissions separate from the response export so unnecessary identity material is not reused or disclosed.
Delete or restrict access to newly collected identity evidence under a documented retention rule once it is no longer needed for the request record or legal claims.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 11 and 12(6) support targeted identity handling when the controller cannot identify the data subject or has reasonable identity doubts.

Section 3

3. Scope the right and the systems to search

Map the request to the GDPR right before collecting data. Access requests under Article 15 require confirmation whether personal data is processed, access to that personal data, specified processing information, and a copy of personal data undergoing processing where applicable. Other rights may require correction, deletion assessment, restriction, portability export, objection handling, or review of solely automated decisions.

The search scope should mirror how the controller actually stores and retrieves personal data. Include active systems, searchable archives, support tools, HR systems, product logs, billing data, processor platforms, and retention locations that may contain personal data about the data subject. For access, provide a faithful and intelligible reproduction of the personal data; the right does not automatically require every original document, although extracts or whole documents may be needed where essential to understand the data.

Access: prepare confirmation, data copy, purposes, categories, recipients or recipient categories, retention period or criteria, rights information, complaint information, source information where not collected from the data subject, and automated-decision information where relevant.
Rectification, erasure, and restriction: identify the relevant records, processing purpose, retention status, recipients that may need notification, and any reason the requested action cannot be completed.
Portability and objection: check whether the request concerns data and processing conditions covered by the relevant Article 20 or Article 21 path before promising an export or stopping processing.
Automated decision-making: identify whether the request concerns a decision covered by Article 22 and preserve the logic, significance, and envisaged-consequence review materials where relevant.
Search plan: list each system, archive, collaboration tool, mailbox, device identifier, processor platform, recipient record, and deletion or retention store to be checked, with owner, query terms, date range, export method, and completion evidence.
Clarification: where the controller holds a large quantity of personal data and the access request is imprecise, ask which information or processing activities are sought only under the Recital 63 conditions; preserve the original request and do not force the person to submit a new one.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 15 to 22 define the rights that a DSAR workflow must route, including access, rectification, erasure, restriction, portability, objection, and automated-decision rights.

EDPB Guidelines 01/2022 on data subject rights - right of access

Explains the scope and form of an Article 15 copy, including when a compilation or original document may be appropriate.

Section 4

4. Build and quality-check the Article 15 response

Build the access response from all three Article 15 components: confirmation whether personal data is processed, access to the personal data itself, and the supplementary information listed in Article 15(1) and 15(2). Where the data has been disclosed, the response should identify the actual recipients unless the person chooses categories, identifying recipients is impossible, or the request is manifestly unfounded or excessive under the applicable EDPB guidance.

Choose the form from the data and the reader's needs. A compilation can work if it reproduces all in-scope personal data without altering meaning; a source document, audio file, image, or contextual extract may be needed when the medium itself carries personal data or the context is necessary to understand it. A portal must allow the person to download the data and cannot hide data that must be supplied another way.

Confirmation check: state whether the controller processes personal data about the person; a no-data result should identify the controller entity and search basis clearly enough to explain the conclusion.
Copy check: reconcile exports by identifier and system, remove duplicates only when no distinct context is lost, preserve timestamps and field meanings, and verify that redaction did not remove the requester's own data unnecessarily.
Supplementary-information check: cover purposes, categories, retention period or criteria, rights and complaint information, source where not collected from the person, transfer safeguards under Article 15(2), and Article 22 information where relevant.
Recipient check: distinguish intended recipient categories in a privacy notice from the actual recipients to whom data was disclosed, and retain the evidence used to identify them.
Format check: use clear labels, explain codes and inferred values, provide a durable and commonly used electronic form where applicable, and avoid requiring paid software to read it.
Layered-response check: use layers only when a large volume would otherwise be difficult to understand, describe every layer at the outset, let the person obtain all layers without a new request or disproportionate effort, and never use layering to reduce scope.
Rights-and-freedoms check: identify the specific competing right, assess the likelihood and severity of harm, try redaction or another reconciliation measure, and record why any withheld material could not be supplied.

Sources for this answer

Regulation (EU) 2016/679 (GDPR), Article 15

Article 15 defines confirmation, access, supplementary information, copy format, transfer-safeguard information, and the rights-and-freedoms limitation.

EDPB Guidelines 01/2022 on data subject rights - right of access

Explains the three access components, actual recipients, compilations and source documents, downloadable electronic copies, layered responses, and Article 15(4) reconciliation.

Section 5

5. Run the one-month response clock

The record should show the Article 12 timing position at all times. The controller must provide information on action taken without undue delay and in any event within one month of receipt. A two-month extension is available where necessary because of request complexity or number, but the data subject must be told within one month of receipt and given the reasons for the delay.

Use the clock record to manage processor requests, internal exports, legal review, redactions, and final delivery. Do not treat internal backlogs, tool limitations, or unclear ownership as an extension reason unless the recorded facts fit the GDPR standard.

Clock fields: receipt date, default due date, response owner, legal reviewer, data owners, processor owners, response target, and escalation date.
Extension fields: complexity or number of requests, affected systems or processors, reason for delay, date notice sent to the data subject, and revised deadline.
Communication fields: response channel, electronic-response preference where the request was electronic, plain-language review, and secure-delivery method.
Delay control: escalate before the deadline when identity verification, processor response, redaction, or rights-and-freedoms review threatens timely closure.
Suspension record: if relying on EDPB access guidance while necessary identity information or a qualifying Recital 63 clarification is outstanding, record the prompt request, why it was necessary, the dates, and the resumed calculation; do not treat this as a general GDPR pause.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12(3) sets the one-month response rule and the two-month extension mechanism for complex or numerous requests.

Section 6

6. Decide response, extension, fee, or refusal

Most requests should close with action taken and a clear response. If the controller does not take action, Article 12 requires notice without delay and at the latest within one month, including reasons and information about complaint and judicial-remedy options.

Fees and refusals need their own evidence path. Article 12 allows a reasonable fee or refusal only where requests are manifestly unfounded or excessive, in particular because of repetitive character, and the controller bears the burden of demonstrating that character.

Response decision: what action was taken, which records or systems were included, what was excluded, what was redacted, and who approved the final package.
Access-copy decision: provide the first copy free of charge, assess any reasonable fee for further copies only by administrative cost, and use redaction or partial disclosure where possible rather than treating the as a blanket refusal ground.
Extension decision: why the request is complex or numerous, what work remains, when the extension notice was sent, and what revised target is being managed.
No-data decision: document identifiers and systems checked, state that the controller does not process matching personal data where that is the supported result, and distinguish a negative confirmation from refusal to act.
No-action decision: factual basis, GDPR right involved, legal reviewer, data-subject notice, complaint language, judicial-remedy language, and approval timestamp.
Fee or refusal decision: evidence that the request is manifestly unfounded or excessive, administrative-cost basis if a fee is charged, and the controller's burden-of-proof record; do not rely on search effort, hostile language, or possible litigation alone.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12(4) and 12(5) govern no-action notices, complaint and remedy information, fees, refusals, and the controller's burden of proof.

EDPB Guidelines 01/2022 on data subject rights - right of access

Explains the first-copy rule, fees for further copies, and the need to reconcile access with the rights and freedoms of others where possible.

Section 7

7. Coordinate processors and preserve evidence

The controller remains accountable for the response, but processors often hold records, logs, exports, deletion controls, or support evidence needed to answer. Article 28 requires processor terms to include assistance, by appropriate technical and organisational measures where possible, for the controller's obligation to respond to Chapter III rights requests.

Close the workflow only when the response package and evidence file align. The evidence file should prove how the request was handled; the data-subject response should contain only the response content that is appropriate to disclose.

Processor evidence: documented instruction, vendor contact, request date, response date, systems searched, export format, no-data confirmation, deletion or restriction confirmation, and unresolved gaps.
Search evidence: repositories searched, search criteria used, data owners contacted, retention constraints, archives checked, and quality-control review.
Disclosure evidence: redaction rationale, third-party rights-and-freedoms review, secure-transfer proof, language or accessibility considerations, final response text, and delivery timestamp.
Action evidence: corrected values, erasure or restriction confirmation, recipient notifications under Article 19, portability file and transmission result, objection outcome, or Article 22 human-review record where the request included those rights.
Reopening triggers: follow-up request, new identifier, late processor response, missed system, correction from the data subject, complaint escalation, or evidence that the original response was incomplete.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 24 and 28 support accountable controller measures and processor assistance for responding to GDPR Chapter III rights requests.

Recommended next step

This guide helps operationalize DSAR intake and response

Sorena can help convert GDPR rights-request intake, identity checks, one-month clock management, processor handoffs, response review, and evidence records into a repeatable DSAR workflow.

Research workflow

Open Research Copilot for EU GDPR

Ask questions tied to cited sources about DSAR intake, identity checks, rights scope, response timing, extensions, refusals, and evidence using the cited GDPR source.

Explore next step

Talk to Sorena

Talk through DSAR operations

Review your GDPR DSAR workflow, processor handoffs, evidence file, and response bottlenecks with Sorena.

Explore next step

Primary sources

References and citations

EDPB Guidelines 01/2022 on data subject rights - right of access

edpb.europa.eu

Referenced sections

Explains the first-copy rule, fees for further copies, and the need to reconcile access with the rights and freedoms of others where possible.

Regulation (EU) 2016/679 (GDPR)

eur-lex.europa.eu

Referenced sections

Articles 24 and 28 support accountable controller measures and processor assistance for responding to GDPR Chapter III rights requests.

"assists the controller"

Regulation (EU) 2016/679 (GDPR), Article 15

eur-lex.europa.eu

Referenced sections

Article 15 defines confirmation, access, supplementary information, copy format, transfer-safeguard information, and the rights-and-freedoms limitation.