dsar-response

Draft acknowledgment and substantive response letters for data subject access requests.

Updated Jun 17, 2026
One-click install
npx skills add https://github.com/tk1cntt/PhapChe --skill dsar-response-tk1cntt
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: dsar-response
Source: https://github.com/tk1cntt/PhapChe/tree/main/docs/claude-for-legal-main/privacy-legal/skills/dsar-response
Command: npx skills add https://github.com/tk1cntt/PhapChe --skill dsar-response-tk1cntt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Responding to a Data Subject Access Request (DSAR) involves strict statutory deadlines, identity verification, system-by-system data location, and exemption analysis — a process where mistakes create regulator exposure. This Skill walks through each step and drafts the required response letters. ## Core Features & Use Cases - Request Classification: Identifies which right is invoked (access, deletion, portability, correction, objection, restriction) and checks escalation triggers before proceeding. - Structured Workflow: Guides identity verification, walks a configurable systems list to locate data, and performs exemption analysis with citation tiering and attorney-review flags. - Two-Letter Drafting: Produces both a prompt acknowledgment letter and a substantive response letter using templates, plus a DSAR log entry for audit purposes. - Use Case: A privacy request email arrives asking to delete an account and export the data first. Paste the request, and the Skill classifies it as deletion plus portability, checks the litigation-hold escalation triggers, and drafts both letters for attorney review. ## Quick Start Paste the incoming data subject request and ask the assistant to walk through the DSAR workflow and draft the acknowledgment and response letters.

Frequently Asked Questions about dsar-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I respond to a data subject access request?

Classify the right invoked, verify the requester's identity, locate their data across every system, analyze applicable exemptions, then send an acknowledgment letter promptly and a substantive response by the statutory deadline. This Skill walks through each step and drafts both letters.

How to draft a GDPR or CCPA deletion request response?

The Skill generates a deletion response template listing what was deleted per system, what was retained with the legal basis and citation, and which third-party processors were instructed to delete. An attorney reviews and approves before anything is sent.

Does the DSAR response clock start at receipt or after identity verification?

The default rule is that the clock starts on receipt of the request, not on completion of identity verification, unless the applicable regime says otherwise. The Skill instructs not to tacitly toll the clock and to cite any regime-specific trigger.

When should a DSAR be escalated to a lawyer?

Escalate when the requester may be a plaintiff, opposing counsel, or journalist, when the scope is unusual, when a litigation hold conflicts with a deletion request, when a prior response is disputed, or when a regulator is copied or mentioned.

What are the limitations of automated DSAR drafting?

The Skill does not query systems directly, does not make exemption calls on close cases, and never sends the response. A human performs the data queries, and a licensed attorney reviews, edits, and approves both letters before they go out.