dsar-response

To process a data subject access request under 152-FZ, you must verify the requester's identity, locate data across systems, assess retention exemptions, and draft a compliant response letter with mandatory DPO sign-off and RKN audit trail documentation.

RKN response deadlines for DSARs under 152-FZ include 30 days for general requests, 10 working days for consent withdrawal, and 7 working days for data correction requests. Correct deadline calculation is required to avoid regulatory fines.

Verify identity and avoid third-party data leaks during a DSAR by applying strict identity verification protocols and cross-system data localization checks before drafting any substantive response, preventing accidental disclosure of third-party personal data.

You should refuse a personal data deletion request under 152-FZ only when applicable retention exemptions apply. Perform an exemption assessment to ensure the refusal is legally motivated, as unmotivated refusals are common RKN violation patterns penalized by fines.

Common RKN violation patterns for mishandling data subject requests include missed deadlines, incorrect identity verification, incomplete responses, unmotivated refusals, and accidental disclosure of third-party personal data. Avoiding these requires end-to-end compliant workflow management.

You can use a DSAR workflow skill for Russian legal compliance even if you are not a DPO, as it guides you through regulatory requirements, exemption rules, and response drafting, but mandatory DPO sign-off is still required for final approval.