How to Handle a Data Subject Access Request (DSAR) in 30 Days — with Template

30-Day DSAR Process

1. Intake & log — channel, timestamp, request type (access vs other rights)
2. Identity verification — proportionate; do not collect excessive ID
3. Scope clarification — if the request is vague, ask promptly (clock management)
4. Systems search — CRM, email, tickets, logs, backups policy, vendor processors
5. Exemptions & redactions — third-party data, legal privilege, manifestly unfounded/excessive
6. Package & deliver — secure channel; include Art 15 information (purposes, categories, recipients, retention, rights, transfers)
7. Close & retain evidence — what was searched, what was withheld and why

Template Outline (Copy into Your Tracker)

How CyberSilo Helps

• Deadline tracking and evidence packs in CSA
• Access-log evidence from ThreatHawk for “who saw what”
• Processor coordination lists tied to Art 28 DPAs

Frequently Asked Questions

What article covers DSARs?

Article 15 (right of access), with response timing under Article 12(3).

Can I charge a fee?

Generally no for the first copy. Manifestly unfounded or excessive requests may allow a reasonable fee or refusal under Article 12(5).

Do processors answer DSARs directly?

Controllers remain responsible. Processors assist under Article 28 contracts.

Related GDPR Resources

GDPR hub · Rights · DPA · SIEM logs · CSA