implementing-gdpr-data-subject-access-request

Register the request with the DSAR workflow engine, verify the requester's identity, then run PII discovery across databases, files, and logs. Map results to Article 15 categories, apply lawful exemptions, and generate the response package with an audit trail.

Use regex pattern matching for structured identifiers like emails and phone numbers, combined with NER via spaCy and Presidio for contextual entities in unstructured text. Consolidate results across all sources to ensure completeness.

The response must confirm whether data is processed, provide a copy of the personal data, and include supplementary information: processing purposes, data categories, recipients, retention periods, data subject rights, data source, and any automated decision-making.

The standard deadline is one calendar month from receipt of a valid request, extendable by two months for complex cases if the subject is notified within the first month. The clock can pause while identity verification is pending.

Exemptions apply for third-party data, legal professional privilege, trade secrets, crime prevention, and management forecasting. Redactions should be sampled and reviewed to confirm only lawful exemptions hide data from the subject.

Discovery usually fails because scans cover only the primary application database and miss log stores, analytics warehouses, backups, CRM, and support tickets. Reconcile scanned sources against the Article 30 record of processing activities to find gaps.