How to Handle Data Subject Access Requests Under GDPR

/The Eight Data Subject Rights

GDPR grants individuals eight specific rights over their personal data. Handling these requests — collectively called Data Subject Access Requests (DSARs) — is mandatory, time-bound, and frequently audited.

• Article 15: Right of access (a copy of their data)
• Article 16: Right to rectification (correct inaccurate data)
• Article 17: Right to erasure ("right to be forgotten")
• Article 18: Right to restrict processing
• Article 19: Notification obligation (inform third parties)
• Article 20: Right to data portability (machine-readable export)
• Article 21: Right to object (incl. direct marketing)
• Article 22: Rights regarding automated decision-making

/Identity Verification

Before disclosing or deleting data, you must verify the requester's identity to prevent unauthorized access. Use existing authentication flows for logged-in users; for offline requests, request proportionate proof of identity. Do not collect more data than necessary for verification.

/Designing for DSAR Automation

Manual DSAR handling does not scale and risks incomplete deletion. The architectural foundation is a single authoritative identity linking to every data store. Without this, an erasure request becomes a forensic hunt across databases, logs, backups, and third-party processors.

interface DataSubjectRequest {
  id: string;
  userId: string;
  type: 'access' | 'rectify' | 'erase' | 'portability' | 'object';
  status: 'received' | 'verifying' | 'in_progress' | 'completed' | 'refused';
  receivedAt: Date;
  dueBy: Date; // receivedAt + 30 days
  completedAt?: Date;
  dataInventory: DataLocation[]; // every store holding this user's data
}

/The Data Inventory Problem

To fulfill an access or portability request, you must know everywhere personal data lives. To fulfill an erasure request, you must delete (or anonymize) it everywhere, including backups within a defined retention window. Maintain a Record of Processing Activities (Article 30) as the source of truth for your data map.

“A right to erasure is meaningless if the data still lives in a stale analytics export, a customer-support ticket, or an un-scanned database replica.”

/Exemptions and Refusals

Not every request must be fulfilled. Legitimate grounds for refusal include other legal obligations (e.g., tax retention), freedom of expression, legal claims, or where the request is manifestly unfounded or excessive. Any refusal must be documented and communicated with the reason and the right to complain to a supervisory authority.

Our platform provides DSAR workflow tooling with an automated data inventory, identity verification, deadline tracking, and templated responses that reduce handling time from weeks to hours. Request a demo to see it in action.