EU Compliance 5 min read
GDPR Data Subject Access Request Checklist: A Practical EU Compliance Guide
A practical, clause-by-clause guide to handling GDPR data subject access requests, from logging and identity checks to redactions, deadlines, and audit evidence.
What Article 15 Requires and Why a Checklist Matters
Article 15 of the GDPR gives individuals the right to obtain confirmation about whether their personal data is processed, access that data, and receive supplementary information. The controller must provide purposes, categories, recipients, retention, rights, source, and automated decision-making details. This is not a records dump; it is a structured response. A GDPR data subject access request checklist helps teams avoid missed deadlines, over-disclosure, and inconsistent redactions. Recital 63 confirms that the right should be exercised easily and at reasonable intervals. Article 12 sets the operational rules: clear communication, secure delivery, and no unnecessary delay.
The Core GDPR Data Subject Access Request Checklist
Use this sequence for every request, whether it arrives by email, web form, phone, or letter.
Step 1: Log and Acknowledge the Request
Record the date received, channel, requester name, and any reference number. The one-month clock starts when the request reaches the controller or any part of it, not when a specific team opens the inbox. Acknowledge receipt if that helps, but do not promise a specific outcome before identity and scope are clear. Assign an owner and create a case file that can survive an audit.
Step 2: Verify Identity Without Over-Collecting
Article 12(6) allows you to ask for additional information when you have reasonable doubts about identity. Use proportionate checks: match the request to existing account data, ask for a signed confirmation, or use a verified channel. Do not demand a passport copy by default. Collect only what is necessary and delete verification material once the request is closed. If the requester uses an agent, confirm authority.
Step 3: Clarify Scope and Search Systems
If a request is broad, ask the requester to narrow it, but do not use clarification as a delay tactic. Search structured and unstructured sources: CRM, HR, email, support tickets, CCTV, backups, analytics, and third-party processors. Document search terms, systems, and custodians. For employee requests, include recruitment, payroll, performance, and access logs. For customer requests, include marketing consent records and complaint histories.
Step 4: Apply Exemptions and Third-Party Redactions
Article 15(4) says the right to a copy must not adversely affect others. Redact third-party names, confidential commercial information, and legal advice where appropriate. Member State law may restrict the right under Article 23 for tax, crime, or national security purposes. Special category data under Article 9 and criminal conviction data under Article 10 need extra care. Do not use exemptions as a blanket refusal; apply them line by line and record the reasoning.
Step 5: Draft the Response and Calculate Deadlines
Article 12(3) requires a response without undue delay and in any event within one month. Complex or numerous requests can be extended by two further months, but you must inform the requester within the first month and explain why. If you refuse, state the reasons and inform the requester of the right to complain to a supervisory authority under Article 77 and to seek a judicial remedy under Article 79. Provide the data in a commonly used electronic format when the request was made electronically.
Step 6: Deliver Securely and Record the Outcome
Send the response through a secure channel. Avoid exposing data in unencrypted email. Keep a copy of the final response, redaction log, and delivery confirmation. Update your Article 30 records of processing if the request reveals a gap. Track metrics: time to acknowledge, time to complete, extension rate, and common exemption types.
Timelines, Fees, and Extensions Under Article 12
The default deadline is one month from receipt. The extension is not automatic; it applies when requests are complex or numerous. Article 12(5) says responses are generally free. You may charge a reasonable fee or refuse to act only for manifestly unfounded or excessive requests, especially repetitive ones. Additional copies may also attract a fee. Document the basis for any refusal or fee. If you process a large volume of requests, publish a clear privacy notice and internal service-level target shorter than the statutory deadline.
Special Cases: Employee DSARs, CCTV, and International Transfers
Employee DSARs often trigger mixed data: the requester's data, colleagues' data, and company confidential information. Redact carefully and involve HR and legal early. CCTV footage is personal data; provide clips where identifiable and redact bystanders. International transfers under Chapter V do not remove access rights, but they can affect where data is held and how quickly you can retrieve it. Processors must assist under Article 28, so include them in your GDPR data subject access request checklist and contract terms.
Documentation and Governance for Repeatable Compliance
A repeatable process needs more than a template. Train staff to recognize requests, including verbal and social media requests. Maintain a request register. Use a DPIA under Article 35 if a new system changes access workflows. Align security controls with Article 32 and keep DPO oversight under Article 37 where required. Review your GDPR data subject access request checklist every year, after supervisory authority guidance, and after any complaint or breach. The goal is defensible consistency: same steps, same evidence, same deadlines.
Related EU Compliance Controls
Product compliance files can contain personal data: test reports, operator logs, and supplier contacts. If your organization handles machinery or notified body documentation, connect privacy workflows with those controls. See the EU Notified Body Involvement Guide for how conformity assessment records are structured, the EU Machinery Regulation 2023/1230 guide for technical documentation duties, and the EU Notified Body Involvement Requirements for when third-party review applies. These links do not replace GDPR duties, but they help avoid silos between compliance teams.
Key facts
Machine-readable statements extracted from the sources above. Each fact keeps the same identifier across all six language versions.
Article 15
The right of access is set out in Article 15 of the GDPR.
Fact ID:
legal_basis1 month
Controllers must respond without undue delay and in any event within one month.
Fact ID:
standard_deadline2 months
The response period can be extended by two further months for complex or numerous requests.
Fact ID:
extension_periodNo fee; reasonable fee for excessive requests
Responses are generally free, but a reasonable fee may apply for manifestly unfounded or excessive requests or additional copies.
Fact ID:
fee_ruleArticle 12(6)
Controllers may request additional information to confirm the requester's identity.
Fact ID:
identity_checkArticle 15(4)
The right to obtain a copy must not adversely affect the rights and freedoms of others.
Fact ID:
third_party_rights
Frequently asked questions
How long do we have to respond to a GDPR data subject access request?
Article 12(3) requires a response without undue delay and in any event within one month. For complex or numerous requests, you can extend the period by two further months, but you must notify the requester within the first month and explain the reason.
Can we charge a fee for a DSAR?
Generally no. Article 12(5) allows a reasonable fee or a refusal to act only when a request is manifestly unfounded or excessive, or when the requester asks for additional copies.
What identity verification can we request?
When you have reasonable doubts about identity, Article 12(6) lets you request additional information. Use proportionate checks and avoid blanket demands such as passport copies unless the risk justifies them.
Can we redact third-party information from a DSAR response?
Yes. Article 15(4) requires that the right to obtain a copy does not adversely affect the rights and freedoms of others. Redact third-party data and confidential information line by line, and document the reasoning.
Does an employee DSAR cover emails and performance reviews?
Yes, if those records contain the employee's personal data. You still need to redact colleagues' data, confidential business information, and legally privileged material where applicable.
What must we tell a requester if we refuse a DSAR?
State the reasons for refusal and inform the requester of the right to lodge a complaint with a supervisory authority under Article 77 and to seek a judicial remedy under Article 79.
Sources and licencing
Every claim in this article traces back to the sources listed below. Links open the publisher directly.
