GDPR & privacy
Data subject requests (DSARs)
A data subject access request is an individual exercising rights the GDPR gives them. Responding is not discretionary, and the deadline runs from receipt rather than from when someone noticed the request.
Transcript
A data subject request is an individual exercising rights the GDPR gives them. Responding is not discretionary. Let's log one.
Those GDPR rights run from Article 15 to Article 22: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a solely automated decision.
Log the requester and the date received. The statutory clock starts at receipt by your organisation, including a request sent to any employee, not just a privacy inbox.
Choosing the request type matters, because the obligations differ. This one is an erasure request under GDPR Article 17: the right to be forgotten.
GDPR Article 22 is where data protection and AI governance meet. If an AI system makes a consequential decision about someone with no meaningful human involvement, they can demand human intervention and contest the outcome.
The request is now tracked against its deadline. GDPR Article 12, paragraph 3 gives you one month from receipt, extendable by two further months for complex requests, but only if you tell the individual inside the first month.
Editing the request assigns it to the team who actually handles it, People Operations here, so it shows up on their view instead of sitting in a shared queue nobody owns.
Moving it to In Progress the moment work starts, not just at the end, is what makes the log honest: the record shows when handling actually began, not only when it finished.
The log itself is evidence. When a regulator asks how you handle data subject rights, a complete record of every request, its deadline and its outcome is the answer.
Why this is required
Articles 15 to 22 set out the rights: access to their personal data and information about how it is processed, rectification of inaccurate data, erasure, restriction of processing, data portability, objection to processing, and the right not to be subject to solely automated decision-making.
Article 22 is where data protection and AI governance meet directly. Where an AI system makes a decision about someone with legal or similarly significant effects and no meaningful human involvement, the individual can demand human intervention, express their point of view and contest the decision. If your high-risk system makes consequential decisions, expect these requests.
Article 12(3) gives you one month from receipt to respond. That can be extended by two further months where the request is complex or numerous, but only if you inform the individual within the first month and explain the reasons for the delay.
Article 12(5) allows you to charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and puts the burden of demonstrating that on you. In practice, refusal is difficult to sustain.
The request log is itself evidence. When a regulator asks how you handle data subject rights, a complete record of every request, its deadline and its outcome is the answer.
What EuroCompliant does
Each request is logged with the date received, and the countdown runs from that date. Status moves from received through in progress to completed.
Overdue and near-deadline requests escalate to the dashboard's urgent alerts rather than sitting quietly in a queue.
The log generates the DSAR register document for your GDPR evidence pack.
Deadlines
Walking through it
Log the request on the day it arrives
The statutory clock starts at receipt by your organisation, including a request sent to any employee, not just a privacy inbox.
Open /privacy-hub →Verify identity proportionately
GDPR's Article 12(6) lets you request additional information where you have reasonable doubts about identity, but verification must not become an obstacle.
Search across your systems
Your system inventory tells you where personal data lives, which is what makes a complete search possible.
Open /systems →Extend only with notice
If you need the two-month extension, tell the individual within the first month and say why. An extension taken silently is simply a missed deadline.
Record the outcome
What was disclosed, what was withheld and on what basis. This is the part that matters if the response is later challenged.
The law
Right of access
The data subject may obtain confirmation of processing, a copy of their data, and information about purposes, recipients and retention.
Right to erasure
Erasure without undue delay where the data is no longer necessary, consent is withdrawn, or processing is unlawful.
Automated individual decision-making
The right to human intervention, to express a view and to contest a solely automated decision with legal or similarly significant effects.
Response deadline
Information must be provided without undue delay and within one month of receipt, extendable by two further months for complex requests with notice.
Frequently asked
Does a request have to be in writing or use a specific form?
No. A request can be made verbally or in writing, to any part of your organisation, and does not have to mention the GDPR. This is why staff awareness matters: an unrecognised request still starts the clock.
Do we have to explain how our AI model reached a decision?
Where Article 22 applies, Articles 13(2)(f), 14(2)(g) and 15(1)(h) require meaningful information about the logic involved, and the significance and envisaged consequences. That is not your model weights. It is an intelligible account of the factors and how they bear on the outcome.
Related guides
GDPR & privacy
How data protection obligations run alongside the AI Act, and the parts of the GDPR that carry operational consequences.
Records of processing (RoPA)
The Article 30 record: the foundational GDPR document, and usually the first thing requested in an investigation.
Breach notification
The seventy-two hour clock under Article 33, what the notification must contain, and when you must tell individuals directly.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial