A response record with scope, searches, redactions, timing and delivery evidence.
STAGE 01
Triage the request
Record receipt time, channel, legal entity and the right being exercised. A person need not use the term DSAR. Identify applicable laws and your role: a processor normally routes the request to its controller under the agreed assistance process. Access, deletion, correction and opt-out requests may have different rules.
Evidence to keep: Request log; owner; applicable-law decision.
STAGE 02
Verify identity proportionately
Use existing authenticated channels where appropriate. Request additional information only where justified and minimise what you collect. Do not demand a passport as the default. Document uncertainty, authorised-agent checks and any clarification without turning them into an unnecessary barrier. Avoid sending real identity documents to unrelated tools.
Evidence to keep: Verification rationale; permitted search identifiers; any clarification.
STAGE 03
Set the correct response clock
Under GDPR Article 12, respond without undue delay and normally within one month of receipt. A further two months may be available for complexity or number of requests; communicate the extension and reasons within the initial month. This is a calendar-month rule, not a universal 30-day rule. Confirm how identity uncertainty affects timing under applicable guidance. California access, deletion and correction requests generally use 45 calendar days, with a possible further 45 days and notice; opt-out and other rights have distinct rules.
Evidence to keep: Deadline and trigger; internal checkpoint; extension decision.
STAGE 04
Search and reconcile
Identify systems, archives, relevant communications, processors and derived records reasonably likely to hold the requested data. Use a controlled evidence workspace, track owners and record search methods and limits. Clarify broad requests where helpful without unlawfully narrowing them. Legal holds do not automatically defeat access rights.
Evidence to keep: Search matrix; supplier requests; reconciliation of missing sources.
STAGE 05
Review disclosure and redaction
Review exemptions against the actual law and document reasons. Protect other people’s rights; consider partial disclosure or redaction rather than blanket refusal. Distinguish copies of personal data from a requirement to release every complete original document. Remove hidden metadata and test exported files. Have a second reviewer inspect difficult decisions.
Evidence to keep: Redaction and exemption log; reviewed response pack.
STAGE 06
Deliver and close
Use a secure channel, an intelligible response and applicable supplementary information about processing. Where not acting, provide required reasons and complaint or remedy information. Record delivery, any follow-up, unresolved systems and proportionate retention of case evidence. Feed recurring problems into inventory and process improvements.
Evidence to keep: Delivery evidence; closed case; corrective-action owners.