Data Subject Access Request (DSAR) Checklist

A DSAR checklist for handling GDPR subject access requests: log the request, verify identity, search every system, redact third parties and reply on time.

Typical schedule per request
The checklist 4 sections, 20 items
Variables {{requester}} {{received_date}}

Use this template Free, no credit card. Imports the checklist into your Runbook organization.

Auf Deutsch lesen: Checkliste Auskunftsersuchen (DSGVO-Auskunft)

Use this checklist whenever someone asks what personal data you hold about them. Requests arrive by email, support ticket, social media or post, and they do not need to use the words "access request" or cite the GDPR to count. The same steps help with deletion and correction requests, with small changes.

Who owns it

Your privacy contact or Data Protection Officer owns the run. System owners search their own tools, because they know where the data hides. Support staff need to know how to recognise a request and hand it over. Adapt this to your jurisdiction; it is a practical checklist, not legal advice. Laws such as the Swiss FADP or UK GDPR have their own rules and deadlines.

Common pitfalls

Missing the start of the clock. The deadline runs from when you receive the request, not from when it reaches the right person. Log it on the day it arrives.
Asking for too much identification. Verify identity in a proportionate way. Asking a known customer for a passport copy creates new risk.
Searching only the main database. Personal data also sits in email, support tickets, chat, logs, backups and spreadsheets.
Disclosing other people's data. Emails and tickets often mention colleagues or other customers. Redact them before sending.
Sending the reply insecurely. Do not send a full data export as a plain attachment to an unverified address.

The checklist: Access request from {{requester}} received {{received_date}}

Log and verify

Log the request with the received date {{received_date}}, channel and due date
Under the GDPR the default deadline is one month from receipt.
Acknowledge receipt to {{requester}} and explain the next steps
Verify the identity of {{requester}} using information you already hold, where possible
Clarify the request with {{requester}} if it is unclear what they are asking for optional
Check whether the request also asks for deletion, correction or a copy in portable format

Find the data

Search the main application database and customer records
Search email, support tickets and chat tools
Search CRM, marketing and newsletter tools
Search HR and finance systems if {{requester}} is or was an employee or supplier
Search file storage and shared spreadsheets
Ask processors to provide data they hold on your behalf optional

Prepare the response

Compile a copy of the personal data in a commonly used electronic format
Redact personal data of other people and confidential third-party information
Record any exemption you rely on and the reason
Write the cover letter with purposes, recipients, retention periods, source of the data and the person's rights
Have a second person review the response before it is sent

Send and close

Send the response through a secure channel before the due date
Inform {{requester}} within the first month if you need an extension, and explain why
The GDPR allows an extension by up to two further months for complex or numerous requests.
Record the date sent, what was disclosed and what was withheld
Delete working copies of the export after the response is sent

Checklist as Markdown

# Access request from {{requester}} received {{received_date}}

## Log and verify
- [ ] Log the request with the received date {{received_date}}, channel and due date
  Under the GDPR the default deadline is one month from receipt.
- [ ] Acknowledge receipt to {{requester}} and explain the next steps
- [ ] Verify the identity of {{requester}} using information you already hold, where possible
- [ ] Clarify the request with {{requester}} if it is unclear what they are asking for (optional)
- [ ] Check whether the request also asks for deletion, correction or a copy in portable format

## Find the data
- [ ] Search the main application database and customer records
- [ ] Search email, support tickets and chat tools
- [ ] Search CRM, marketing and newsletter tools
- [ ] Search HR and finance systems if {{requester}} is or was an employee or supplier
- [ ] Search file storage and shared spreadsheets
- [ ] Ask processors to provide data they hold on your behalf (optional)

## Prepare the response
- [ ] Compile a copy of the personal data in a commonly used electronic format
- [ ] Redact personal data of other people and confidential third-party information
- [ ] Record any exemption you rely on and the reason
- [ ] Write the cover letter with purposes, recipients, retention periods, source of the data and the person's rights
- [ ] Have a second person review the response before it is sent

## Send and close
- [ ] Send the response through a secure channel before the due date
- [ ] Inform {{requester}} within the first month if you need an extension, and explain why
  The GDPR allows an extension by up to two further months for complex or numerous requests.
- [ ] Record the date sent, what was disclosed and what was withheld
- [ ] Delete working copies of the export after the response is sent

Frequently asked questions

How long do I have to respond to a subject access request under the GDPR?

You must respond without undue delay and at the latest within one month of receiving the request. You can extend this by up to two further months if the request is complex or you have received many requests, but you must tell the person within the first month and explain why.

Can I charge a fee for a DSAR?

Normally no. A first copy must be provided free of charge. You may charge a reasonable fee for further copies, or for requests that are manifestly unfounded or excessive, and in those cases you may also refuse. Record the reasoning if you do.

What information must a DSAR response include?

Besides a copy of the personal data, the GDPR requires you to explain the purposes of processing, the categories of data, the recipients, the retention period, the person's rights, the source of the data if you did not collect it from them, and whether automated decision-making is used.

Updated 2026-11-04