One calendar month. That is the window Article 12(3) of the GDPR gives you to answer a Data Subject Request (DSR), and it starts on the day anyone in your organisation receives it. Miss it and the failure falls into the higher fine tier of Article 83(5), with penalties reaching €20 million or 4% of global annual turnover.
Most of that month disappears into scattered data and slow sign-off rather than hard legal questions. This checklist draws on more than 10,000 DSRs that Regulativ's team has processed across 200+ organisations, and it breaks the month into four phases with clear actions for each day.
Understanding the Seven Data Subject Rights
Each right carries different obligations. Identify which one the requester is using before you start work, because the wrong assumption on day one can cost you a week later.
The Seven Data Subject Rights at a Glance
| Right | Article | What the individual asks for | What you must do |
|---|
| Access | Article 15 | To know what personal data you process about them | Provide a copy of the data plus the supplementary information in Article 15(1) |
| Rectification | Article 16 | Correction of inaccurate or incomplete data | Correct the data and confirm the change |
| Erasure | Article 17 | Deletion of their personal data ("right to be forgotten") | Delete and confirm, explaining anything retained under Article 17(3) |
| Restriction | Article 18 | Processing limited without deletion | Mark the data as restricted and explain the limits |
| Portability | Article 20 | Their data in a machine-readable format | Provide a structured, commonly used format, or transmit it to another controller where feasible |
| Objection | Article 21 | An end to processing for specific purposes | Stop processing unless you have compelling legitimate grounds; direct marketing objections must always be honoured |
| Automated decision-making | Article 22 | Not to be subject to solely automated decisions with significant effects | Offer human intervention and explain the decision logic |
⚖️ What the Law Says
The European Data Protection Board (EDPB) confirms in Guidelines 01/2022 that a requester does not have to mention the GDPR, use the phrase "subject access request", or explain why they want their data. Requests can arrive by email, web form, post, phone or social media, and can reach any member of staff. Article 12(2) requires you to make exercising these rights easy.
Train front-line teams to recognise a request and forward it on the day it arrives.
The 30-Day DSR Processing Framework
Split the month into four phases and give each one a hard end date. Closing by day 25 leaves room for legal sign-off without touching the statutory deadline.
DSR Response Timeline: Four Phases
| Phase | Days | Goal | Outputs |
|---|
| 1. Receipt and validation | 1 to 3 | Log, acknowledge and verify the requester | Case ID, acknowledgement sent, identity confirmed |
| 2. Data location and collection | 4 to 14 | Find and extract every relevant record | Systems searched, extraction log |
| 3. Review and processing | 15 to 25 | Filter, redact and draft the response | Redacted data set, draft response |
| 4. Final review and response | 26 to 30 | Quality assurance, approval and delivery | Signed-off response, delivery record |
📅 Key Insight: "30 Days" Is Shorthand
The legal deadline is one calendar month. The UK Information Commissioner's Office (ICO) counts from the day you receive the request to the corresponding date in the following month, so a request received on 3 March is due on 3 April. Where that date does not exist, the deadline falls on the last day of the month. A request that lands on 31 January is due on 28 February, which leaves you 28 days.
Phase 1: Initial Receipt and Validation (Days 1 to 3)
The first 24 hours decide whether you have a calm month or a frantic one.
Within 24 hours of receipt. Log the request in your DSR tracking system, assign a unique case ID and record the receipt timestamp. Acknowledge receipt to the data subject, set the deadline one calendar month from receipt, and notify the DSR response team.
Days 2 to 3: identity verification. Match the request details against customer records and confirm the requester's authority for any third-party request. Clarify which data or processing activities are in scope before collection starts.
Identity Verification: Red Flags and Proportionate Responses
| Red flag | Proportionate response |
|---|
| Generic email address that does not match your records | Send a verification code to the email address already on file before asking for any ID document |
| Request from a family member without proof of authority | Ask for signed authorisation or evidence of legal standing, such as a power of attorney |
| Unusually broad or vague request | Ask the requester to specify the information they want (Recital 63), while the EU GDPR clock keeps running |
| Request that looks commercially motivated or linked to a dispute | Answer it anyway. The EDPB says motive is irrelevant unless the request is manifestly unfounded or excessive |
| Several requests from the same person in a short period | Assess whether the pattern is manifestly excessive under Article 12(5) and record your reasoning |
⚠️ Keep Verification Proportionate
Article 12(6) lets you ask for extra information only where you have reasonable doubts about who is asking. The EDPB's coordinated enforcement report on the right of access, published on 20 January 2025, listed demands for excessive identification documents among the main barriers people face. Ask for the least you need before you ask anyone for a passport scan.
🇬🇧 UK Organisations: The Clock Can Pause
Article 12A of the UK GDPR, inserted by the Data (Use and Access) Act 2025 and in force since 5 February 2026, lets you stop the clock while you wait for identity confirmation or clarification of scope, where you cannot reasonably proceed without it. Record the date you asked and the date the requester replied. The EU GDPR has no equivalent pause, so start EU identity checks on day one.
Phase 2: Data Location and Collection (Days 4 to 14)
Most incomplete responses fail at this stage. Your Article 30 record of processing activities is the fastest starting point, because it already maps the categories of personal data you hold and who receives them.
Where Personal Data Lives: Systems to Search
| System | What to look for |
|---|
| CRM | Contact details, account notes and interaction history |
| Transaction and billing systems | Orders, invoices, payment methods and transaction history |
| Marketing automation | Email engagement, campaign participation and consent records |
| Customer service ticketing | Tickets, chat transcripts and call notes |
| Security and access logs | Login records, IP addresses and device data |
| Backup and archive storage | Historic copies of live records |
| Third-party processors | Data held or processed on your behalf |
| Employee email and shared drives | Correspondence and documents that name the requester |
| Collaboration tools (Slack, Microsoft Teams) | Messages and shared files |
| Call recordings and CCTV | Audio and footage in which the requester is identifiable |
| Physical records | Paper files and archived forms |
Days 8 to 14: data extraction. Run queries using customer identifiers, search email systems, and pull service logs, campaign records and transaction history. Ask each processor for the data it holds, and log every source and collection method as you go.
⚖️ How Far Must the Search Go?
In the UK, the Data (Use and Access) Act 2025 now states in legislation that you must carry out a reasonable and proportionate search. Under the EU GDPR, Recital 63 allows a controller holding a large quantity of information about someone to ask them to specify what the request relates to.
Either way, record which systems you searched, the search terms you used and why you excluded anything. That record is your evidence if a regulator later questions the response.
Phase 3: Data Review and Processing (Days 15 to 25)
Over-disclosure happens at review, so run every item through the same checks before it goes near the response.
Review Checks Before Disclosure
| Check | What to do |
|---|
| Relevance | Confirm every item relates to the requesting individual |
| Third-party data | Redact other individuals' personal data, as Article 15(4) permits |
| Privilege | Identify legally privileged or confidential material |
| Intellectual property | Protect trade secrets and proprietary algorithms |
| Security classification | Handle sensitive data according to your security protocols |
⚠️ Exemptions Need a Documented Reason
Article 15(4) permits redaction where disclosure would affect the rights and freedoms of others. It does not permit a blanket refusal. The EDPB's January 2025 enforcement report found controllers leaning too heavily on exceptions to refuse access automatically, so redact line by line and record the reason for each exemption.
Days 21 to 25: response preparation. For access requests, Article 15 sets out exactly what the response must contain.
What an Access Request Response Must Include
| Element | GDPR reference |
|---|
| A copy of the personal data in a commonly used format | Article 15(3) |
| Purposes of processing | Article 15(1)(a) |
| Categories of personal data | Article 15(1)(b) |
| Recipients or categories of recipients | Article 15(1)(c) |
| Retention period, or the criteria used to set it | Article 15(1)(d) |
| The rights to rectification, erasure, restriction and objection | Article 15(1)(e) |
| The right to complain to a supervisory authority | Article 15(1)(f) |
| The source of the data, where you did not collect it from the individual | Article 15(1)(g) |
| Automated decision-making, including the logic involved | Article 15(1)(h) |
| Safeguards for transfers outside the UK or EEA | Article 15(2) |
Responding to Other Request Types
| Request | Action | Also required |
|---|
| Rectification | Correct the data and confirm the change | Notify recipients under Article 19 |
| Erasure | Delete the data and confirm deletion | Notify recipients and explain anything kept under Article 17(3) |
| Restriction | Mark the data as restricted and explain the limits | Notify recipients, and inform the individual before lifting the restriction (Article 18(3)) |
| Portability | Provide data in a structured, machine-readable format | Transmit directly to another controller where technically feasible (Article 20(2)) |
| Objection | Stop processing and confirm | Treat any objection to direct marketing as absolute (Article 21(3)) |
⚖️ Tell Everyone You Shared the Data With
Article 19 requires you to notify each recipient of any rectification, erasure or restriction, unless that proves impossible or involves disproportionate effort. If the data subject asks, you must also tell them who those recipients are. Add processors, marketing partners and group companies to your notification list before you close the case.
Phase 4: Final Review and Response (Days 26 to 30)
Days 26 to 28: quality assurance. Your legal team reviews the response for completeness and accuracy, and the privacy officer approves the content. Someone other than the drafter should confirm that every requested item is addressed and all third-party data is redacted.
Days 29 to 30: delivery. Send the response through encrypted email or a secure portal, and explain the actions taken in plain language. Include your Data Protection Officer's contact details, your complaints procedure and the right to complain to a supervisory authority such as the ICO.
🚩 Extending or Refusing Has Its Own Deadline
- Extending: Article 12(3) allows two further months where requests are complex or numerous. You must tell the requester within the first month and explain why.
- Refusing: Article 12(5) permits refusal, or a reasonable fee, only where a request is manifestly unfounded or excessive, and the burden of proof sits with you. Article 12(4) requires you to explain the refusal within one month.
Staying silent past the deadline is the worst outcome, because it counts as a breach even when a refusal would have been lawful.
🇬🇧 UK: Include Your Complaints Route From 19 June 2026
Section 164A of the Data Protection Act 2018, added by the Data (Use and Access) Act 2025, requires controllers to offer a way for people to complain about how their data has been handled, including an electronic complaint form, and to acknowledge complaints within 30 days. Link that process in every DSR response.
💰 GDPR Penalty Structure for Data Subject Rights
€20 million or 4% of global annual turnover: failures under Articles 12 to 22, Article 83(5)
£17.5 million or 4% of global annual turnover: the UK GDPR equivalent
€10 million or 2% of global annual turnover: other obligations, such as Article 30 records, Article 83(4)
Sample Access Request Response
Adapt this template to your own processing before use. Check each line against the Article 15 table above, because the source of the data, the recipients and the right to complain must all appear.
📄 Template: Response to Your Data Access Request
Subject: Response to Your Data Access Request, Reference: [CASE-ID]
Dear [DATA SUBJECT NAME],
Thank you for your data access request received on [DATE]. We are pleased to provide the following information about the personal data we process about you.
Categories of personal data we process: identity and contact information; financial information; service usage data; technical data such as IP addresses and device information.
Purposes of processing: service provision and account management; payment processing and financial record keeping; customer support; legal compliance and fraud prevention.
Recipients: [CATEGORIES OF RECIPIENTS]. Source: [WHERE NOT COLLECTED FROM YOU].
Data retention: We retain your personal data for [PERIOD] or until you request deletion, whichever comes first.
Your rights: You may request rectification, erasure, restriction or portability of your data, object to processing, and complain to the Information Commissioner's Office or your local supervisory authority.
A complete copy of your personal data is attached securely. If you have any questions, please contact our Data Protection Officer at [CONTACT DETAILS].
Best regards,
[ORGANISATION NAME] Privacy Team
Common Pitfalls and How to Avoid Them
DSR Pitfalls: Risk and Solution
| Pitfall | Risk | Solution |
|---|
| Incomplete data discovery | Missing data in backups or third-party processors | Maintain a full data inventory and processor map |
| Over-disclosure | Revealing other individuals' personal data | Use systematic redaction and dual review |
| Timeline violations | Missing the one-month deadline on complex cases | Start on day one and extend formally within the first month |
| Inadequate verification | Disclosing data to a fraudulent requester | Document a proportionate identity verification procedure |
| Silence past the deadline | A breach even where refusal would have been lawful | Send a reasoned refusal or extension notice in time |
Measuring and Scaling DSR Performance
Request volumes rise as people learn their rights, and organisations holding millions of customer records should plan for 100 to 1,000+ requests a month. You cannot manage that volume without measuring it.
DSR Key Performance Indicators
| KPI | What it measures |
|---|
| Response time | Average days from receipt to response |
| Completeness rate | Percentage of requests fully satisfied on first response |
| Error rate | Frequency of data inaccuracies or over-disclosure |
| Cost per request | Total processing cost divided by request volume |
| Satisfaction score | Data subject feedback on response quality |
⚖️ Regulators Are Already Checking
Throughout 2024, 30 data protection authorities across Europe examined how 1,185 controllers handle the right of access under the EDPB's Coordinated Enforcement Framework. The EDPB's report, adopted on 20 January 2025, named the lack of documented internal procedures as one of seven key challenges. A written, dated DSR procedure is the first document a supervisory authority is likely to request.
Manual vs Automated DSR Processing
Manual processing breaks down at scale. Regulativ's compliance automation platform cuts DSR handling from 2 to 3 hours to around 15 minutes per request.
Manual vs Automated DSR Handling: Business Impact
| Metric | Manual process | With Regulativ |
|---|
| Time per request | 2 to 3 hours | Around 15 minutes |
| Data discovery | Manual searches system by system | AI agents locate personal data across connected systems |
| Deadline tracking | Spreadsheets and calendar reminders | Automated tracking, with zero missed deadlines reported |
| Response accuracy | Depends on the individual reviewer | 99.8% accuracy reported in response generation |
| Audit trail | Assembled after the fact | Recorded as the case progresses |
| Manual effort | Full analyst time on every case | 90% reduction reported |
Automated data discovery. Regulativ's AI agents locate personal data across connected systems in seconds.
Response generation. Draft compliant DSR responses with the Article 15 information already structured.
Cross-system integration. Connect to CRMs, databases and third-party processors.
Audit trail management. Keep complete documentation of every search, redaction and approval.
Multi-jurisdiction support. Handle GDPR, UK GDPR and CCPA requests from one platform.
Regulativ's industry solutions cover financial services, healthcare and technology, and our compliance consultancy supports complex cases such as conflicting requests, processor coordination and legacy system limits.
✅ Bottom Line
A DSR is won or lost in the first three days. Log it on day one, verify proportionately, search every system mapped in your Article 30 record, and close by day 25. Organisations that work this way treat the one-month deadline as routine, and they can prove it when a regulator asks.
Test yourself. How many of these steps could your team complete today for a request that arrived this morning?
Book a personalised demo →
Frequently Asked Questions
What is a Data Subject Request (DSR) under GDPR?
A Data Subject Request is a formal request from an individual exercising their rights over their personal data under the GDPR. You must respond within one calendar month of receipt, free of charge in most cases.
How long do you have to respond to a GDPR Data Subject Request?
One calendar month from the day you receive it, under Article 12(3). Complex or numerous requests can be extended by two further months if you tell the requester within the first month.
Can you refuse a GDPR Subject Access Request?
Only where the request is manifestly unfounded or excessive under Article 12(5), and you carry the burden of proving it. Third-party data can be redacted under Article 15(4), but that does not justify refusing the whole request.
How do you verify identity for a GDPR data subject request?
Match the request against your existing records and ask for the least extra information you need, such as a code sent to the email address on file. Article 12(6) only allows additional checks where you have reasonable doubts.
What are the GDPR fines for failing to respond to a data subject request?
Failures under Articles 12 to 22 fall into the higher tier of Article 83(5): up to €20 million or 4% of global annual turnover. The UK GDPR equivalent is £17.5 million or 4%.
Can UK organisations pause the one-month deadline?
Yes. Since 5 February 2026, Article 12A of the UK GDPR lets a controller pause the clock while waiting for identity confirmation or clarification of scope. The EU GDPR has no equivalent pause.
Can AI automate GDPR Data Subject Request processing?
Yes. AI-powered DSR platforms automate data discovery, redaction, response drafting and audit logging. Regulativ customers report handling time falling from 2 to 3 hours to around 15 minutes per request.
