Sample DSAR Evidence Pack
See what a complete, well-documented DSAR response looks like. This is the kind of output you can produce with SAR Portal — and the evidence regulators look for.
1 Request Intake
When a data subject submits a request, SAR Portal captures all required information and starts the one-month countdown automatically.
📄 Data Subject Access Request
GDPR Article 152 Identity Verification
Where you have reasonable doubts about who is making the request, confirm the requester's identity before releasing personal data, using proportionate checks. SAR Portal documents this step.
👤 Identity Verification Record
✓ Verified3 Redacted Documents
Third-party personal data should be considered and redacted where disclosure would not be reasonable. SAR Portal's AI identifies and suggests redactions for this, which your team reviews and approves.
📧 Email Thread (Redacted)
Imported from Outlook .msg → PDF - 3 pagesFrom: ████████████ <████████████>
To: Sarah Mitchell <sarah.mitchell@email.com>
Cc: ████████████
Sent: 14 March 2023, 16:42
Subject: Re: Your file — documents attached
Attachment: Review_Summary_SMitchell.pdf (redacted separately)
Hi Sarah,
Following our meeting, I've attached the summary document for your records. As discussed, I also spoke to ████████ at ████████████ about the timing, and they confirmed the paperwork can be processed this month.
One thing to flag — ████████ raised the same question last week, so I've included the note we prepared for them as background.
Give me a shout if anything's unclear.
Redaction note: sender, copied recipient, third-party contacts and another client's name removed as third-party personal data (GDPR Article 15(4)). Original .msg imported with its attachment and converted to PDF; attachment redacted as a separate item in the same batch.
📄 Account Information Export
PDF - 1 page4 Final Response
The complete response package sent to the data subject, fulfilling your Article 15 obligations.
📧 Response Letter
✓ SentAcme Corporation Ltd
123 Business Park, London, EC1A 1BB
dpo@acme-corp.com
9 June 2026
Dear Ms Mitchell,
Re: Your Data Subject Access Request (Ref: SAR-2026-00147)
Thank you for your request dated 12 May 2026 for access to your personal data under Article 15 of the GDPR (Regulation (EU) 2016/679, and the UK GDPR as retained in UK law).
We have completed our search of our systems and are pleased to enclose the following:
Enclosed Documents:
- Email correspondence, imported from Outlook and converted to PDF (3 pages, redacted)
- Email attachment — Review Summary (2 pages, redacted)
- Account Information Export (1 page)
- Transaction History (3 pages)
- Marketing Preferences Record (1 page)
Information about processing:
- Purposes: Service delivery, customer support, marketing (with consent)
- Legal basis: Contract performance, legitimate interests, consent
- Recipients: Stripe (payments), Mailchimp (marketing)
- Retention: Account data retained for 7 years after account closure
- Your rights: Rectification, erasure, restriction, portability, objection
Please note that some information has been redacted to protect the personal data of third parties — including our staff, other clients and individuals at third-party organisations — as permitted under Article 15(4), which provides that the right to obtain a copy shall not adversely affect the rights and freedoms of others.
Right to complain: If you are dissatisfied with this response, you may lodge a complaint with the relevant supervisory authority — in Ireland, the Data Protection Commission (dataprotection.ie); in the United Kingdom, the Information Commissioner's Office (ico.org.uk).
If you have any questions about this response or wish to exercise any other rights, please contact us at dpo@acme-corp.com.
Yours sincerely,
John Smith
Data Protection Officer
Acme Corporation Ltd
5 Complete Audit Trail
Immutable record of every action taken - exactly what a regulator would request during an investigation.
📋 Audit Log - Case SAR-2026-00147
Immutable RecordWant to know how we protect your data?
Learn about our security measures, GDPR compliance, and data residency options.
Visit Trust Center →Ready to produce evidence packs like this?
Walk through it with us on a real request, or start a free trial and handle your first one yourself — complete audit trail and AI-assisted redaction either way.
No credit card required. Full access to all features.