When your organization receives a Data Subject Access Request (DSAR) under GDPR Article 15, here's the compliance process you must follow:
Initial Response and Verification (GDPR Requirements)
Acknowledge receipt promptly and inform the data subject of their rights. While GDPR doesn't specify an acknowledgment timeframe, best practice is within 72 hours to demonstrate compliance commitment.
Verify the identity of the data subject making the request to prevent unauthorized disclosure under Article 12(6). Request additional identification if needed, but ensure verification requirements are proportionate and don't create barriers to exercising GDPR rights.
Clarify the scope if the request is unclear or overly broad. Under Article 12(5), you can request clarification, but this doesn't extend your response deadline unless the request is manifestly unfounded or excessive.
Processing Under GDPR Framework
Conduct a comprehensive data mapping search across all processing activities where the individual's personal data might be stored. This includes all systems covered in your Article 30 records of processing activities, third-party processors under Article 28, and any international transfers under Chapter V.
Involve your Data Protection Officer (DPO) if appointed, and coordinate with relevant departments including IT, HR, customer service, marketing, and legal teams to ensure GDPR compliance across all data processing.
Document your search methodology and maintain records demonstrating compliance with Article 5(2) accountability principle.
Preparing the GDPR-Compliant Response
Compile all personal data as required under Article 15(1), including the purposes of processing, categories of data, recipients or categories of recipients, retention periods, and information about automated decision-making including profiling.
Provide information about data subject rights under Articles 16-22, including the right to rectification, erasure, restriction of processing, data portability, and objection.
Include source information where the personal data was not collected directly from the data subject, as required under Article 15(1)(g).
Remove third-party personal data to comply with data protection principles, unless disclosure is legally required or the third party has consented.
GDPR Legal Compliance and Deadlines
Respond within one month from receipt of the request as mandated by Article 12(3). This can be extended by two additional months for complex requests, but you must inform the data subject within the first month and explain the reasons for delay.
Provide information free of charge under Article 12(5), unless the request is manifestly unfounded or excessive, particularly if repetitive. If charging a fee, it must be reasonable and based on administrative costs.
Consider GDPR exemptions under national implementations, such as legal privilege, prevention/detection of crime, or protection of others' rights and freedoms, but document your legal basis for any exemptions applied.
GDPR-Compliant Final Steps
Deliver the response securely using appropriate technical and organizational measures under Article 32. Consider encryption for electronic delivery or secure registered post for sensitive data.
Provide data in a structured, commonly used, and machine-readable format when feasible, supporting the data subject's right to data portability under Article 20.
Maintain comprehensive records of the entire DSAR process as part of your Article 5(2) accountability obligations and potential supervisory authority inquiries.
Monitor for follow-up requests as the data subject may exercise additional rights such as rectification, erasure, or restriction of processing based on the information provided.
GDPR Enforcement Considerations
Under GDPR Article 83, failure to respond to a DSAR can result in administrative fines up to €20 million or 4% of annual global turnover, whichever is higher. Supervisory authorities also consider compliance history, cooperation, and technical/organizational measures when determining penalties.
Ensure your organization has documented DSAR procedures, staff training on GDPR requirements, and clear escalation processes to demonstrate proactive compliance with EU data protection law.
Related Keywords: GDPR Article 15, EU data protection compliance, data subject rights GDPR, GDPR Article 12 response time, supervisory authority requirements, GDPR fines Article 83, data protection officer duties, GDPR accountability principle