DSAR Response Checklist Template

The first task’s answers set the early due dates, show the UK-only steps and assign the release approval.

• Log the request on the day it reaches the organisation — record the receipt date, channel, requester, regime and privacy lead; a phone call to a shop manager can count
• Confirm what is being asked for — an access request needs no form, legal wording or reason; log any erasure or objection request separately
• Check the authority of anyone acting for the requester — a solicitor, relative or claims firm needs written authority; the ICO starts the UK clock once you have it
• Acknowledge receipt and state the deadline — the EDPB recommends confirming receipt in writing with the dates the month runs between
• Suspend routine deletion of the requester’s data — the answer reflects what you held on receipt, so pause automated purges for this person

The clarification step is UK-only. From Phase 3, due dates run from the clock start date recorded here.

• Decide whether identity is genuinely in doubt — Article 12(6) allows extra checks only on reasonable doubts; a logged-in customer is usually already authenticated
• Ask for the least information that settles the doubt, the same day — a matching account detail before a passport; let the requester black out what the check does not need
• Record the clock start date — EU: the receipt date, not counting time spent waiting for identity details you asked for promptly; UK: the latest of receipt, identity information and any fee
• UK: pause the clock only for clarification you reasonably need — typically where you hold a lot about the person; ask at once and record when the pause starts and ends
• Screen for manifestly unfounded or excessive requests — read both terms narrowly and keep the evidence; the burden of proof is yours, and a refusal still needs reasons in time

The extension notice appears only when the extension decision is answered Yes.

• Map where the requester’s data could sit — start from the records of processing: CRM, HR, email, chat, tickets, call recordings, CCTV and processors
• Send search instructions to each system owner — names, email addresses, IDs and the date range, with results due back within ten days
• Ask processors to search their systems — Article 28(3)(e) obliges them to help, and data they hold for you is in scope
• Run mailbox and messaging searches and keep a search log — record the terms, mailboxes, channels, date ranges and hit counts
• UK: record why the search was reasonable and proportionate — Article 15(1A) limits the duty to what such a search finds; note why any location was left out
• Decide by day 20 whether an extension is needed — the grounds are the complexity or number of the requester’s requests, not an internal backlog
• Send the extension notice before the first month ends — tell the requester the new deadline and the reasons

The two redaction tasks appear only when the material identifies other people.

• Review the collated material and flag third-party data — remove duplicates, keep what relates to the requester, including opinions about them, and note whether others are identifiable
• Weigh disclosure for each identifiable third party — seek consent where practical, otherwise judge whether disclosure is reasonable given confidentiality and any refusal
• Redact what you withhold and keep an unredacted master — remove the text rather than masking it, log each redaction and leave context for the rest
• Apply exemptions only where the facts fit — for example legal privilege, negotiations or confidential references under DPA 2018 Schedule 2, or an EU member state’s Article 23 restrictions
• Have a second person check the bundle — someone who did not run the search checks scope, redactions and exemptions

The last task is an approval assigned to the privacy lead or DPO named in Phase 1.

• Draft the Article 15 information for this requester — purposes, categories, recipients, retention, rights, source, automated decisions and transfer safeguards, tailored to this person
• UK: include both complaint routes — to you under DPA 2018 section 164A and to the Information Commission, still known as the ICO, as Article 15(1)(ea) and (f) now require
• Prepare the copy in a usable format — a commonly used electronic form if the request came electronically, with whole documents where extracts alone would not make sense
• Explain anything withheld or refused — state the ground; where you take no action, Article 12(4) requires the reasons and the routes to complain and to seek a judicial remedy
• Privacy lead or DPO approves the release — checks the bundle, letter and delivery method, then records Approved or Not approved

The Phase 3 extension answer decides which delivery task appears. If the UK clock was paused, move its due date on by the paused days.

• Send the response within one month of the clock start — use an agreed secure channel and confirm the address; a misdirected bundle is a personal data breach
• Send the response by the extended deadline — within three months of the clock start, releasing what is ready earlier
• Handle follow-up questions and further copies — a reminder that the answer was incomplete is not a new request; a fee is allowed only for further copies
• UK: log any complaint about the handling — acknowledge it within 30 days, look into it and tell the requester the outcome without undue delay, under section 164A
• Close the case file and lift the deletion hold — keep the response, logs and approval for the period your retention schedule sets
• Record the outcome in the request log — clock start, paused days, extension, fee, exemptions and days taken, ready for the quarterly metrics review