Free GDPR Resources

Day 0: Request Received

• ☐ Log request with date/time received
• ☐ Calculate 30-day deadline
• ☐ Send acknowledgement within 24 hours
• ☐ Assign case owner

Days 1-3: Verification

• ☐ Verify requester identity
• ☐ Confirm request type (access, deletion, correction, etc.)
• ☐ Clarify scope if unclear
• ☐ Document verification method

Days 4-14: Data Collection

• ☐ Search all relevant systems
• ☐ Export data from each source
• ☐ Check email and file shares
• ☐ Request data from third parties if needed
• ☐ Document data sources searched

Days 15-21: Processing

• ☐ Review all collected data
• ☐ Redact third-party personal data
• ☐ Check for exemptions (legal, harm, etc.)
• ☐ Prepare response document

Days 22-28: Review

• ☐ Quality review by second person
• ☐ Verify completeness
• ☐ Check all redactions
• ☐ Prepare delivery method

Day 29-30: Delivery

• ☐ Send response via secure method
• ☐ Include cover letter explaining response
• ☐ Log completion date
• ☐ Store case documentation

Core Business Systems

• ☐ CRM (Salesforce, HubSpot, etc.)
• ☐ Email marketing platform
• ☐ E-commerce platform
• ☐ Accounting software
• ☐ HR/Payroll system
• ☐ Customer support tickets

Communication Systems

• ☐ Email (inbox and sent folders)
• ☐ Slack/Teams messages
• ☐ Video call recordings
• ☐ Phone call logs/recordings
• ☐ SMS/WhatsApp business

File Storage

• ☐ Shared drives (Google Drive, OneDrive)
• ☐ Local computer files
• ☐ Backup systems
• ☐ Paper files (scan if needed)

Often Forgotten

• ☐ CCTV footage
• ☐ Access logs/badge records
• ☐ Website analytics (if identifiable)
• ☐ Social media DMs
• ☐ Third-party tools with personal data
• ☐ Old/archived systems

What to Redact (Third-Party Data)

• ☐ Other people's names
• ☐ Other people's email addresses
• ☐ Other people's phone numbers
• ☐ Other people's addresses
• ☐ Other people's ID numbers
• ☐ Information that could identify others indirectly

What NOT to Redact

• ☐ The requester's own personal data
• ☐ Staff names acting in professional capacity (usually)
• ☐ Company/organisation names (not personal data)
• ☐ Public information

Redaction Quality Checks

• ☐ Search for all instances of each name/identifier
• ☐ Check headers, footers, and metadata
• ☐ Verify redactions are permanent (not just visual overlays)
• ☐ Review redacted document in different viewers
• ☐ Confirm no partial redactions reveal information

Common Mistakes to Avoid

• ☐ Don't redact using black highlight (text still underneath)
• ☐ Don't forget email CC/BCC fields
• ☐ Don't miss names in email signatures
• ☐ Don't overlook document properties/metadata
• ☐ Don't leave initials that identify individuals

What is a DSAR?

A Data Subject Access Request (DSAR) is when someone asks to see what personal data you hold about them. Under GDPR, you must respond within 30 days.

Who Can Make a DSAR?

• Customers (current or former)
• Employees (current or former)
• Website visitors (if you have their data)
• Anyone whose data you process

What Must You Provide?

• Confirmation you hold their data
• A copy of all personal data you hold
• Why you're processing it
• Who you've shared it with
• How long you'll keep it
• Their rights (deletion, correction, etc.)

The 30-Day Deadline

The clock starts when you receive the request - not when you read it. You can extend by 2 months for complex requests, but you must tell the requester within 30 days and explain why.

What Happens If You Don't Comply?

• Complaint to Data Protection Commission
• Potential fines starting at €10,000+
• Reputational damage
• Legal action from the individual

Mistake 1: Missing the Deadline

The Problem: Responding after 30 days without valid extension.

The Fix: Log requests immediately and track deadlines centrally. Set reminders at 14, 7, and 3 days.

Mistake 2: Incomplete Response

The Problem: Not searching all systems or "forgetting" certain data.

The Fix: Maintain a data inventory. Search every system systematically. Document what you searched.

Mistake 3: Sharing Third-Party Data

The Problem: Accidentally including other people's personal data in the response.

The Fix: Review every document. Redact all third-party information. Use AI tools to catch what humans miss.

Mistake 4: No Audit Trail

The Problem: Can't prove you handled the request properly when challenged.

The Fix: Log every action with timestamps. Keep records of what was searched, provided, and when.

Mistake 5: Excessive ID Requirements

The Problem: Demanding unnecessary verification that blocks legitimate requests.

The Fix: Only verify identity when you have reasonable doubt. Email confirmation is often sufficient.

Copy and customise this template for acknowledging DSAR receipt:

Use when you need to verify the requester's identity:

Include this cover letter when delivering DSAR responses: