For DPOs, privacy, legal, HR, customer service and IT teams
The DSAR Toolkit
Handle data subject rights requests from first contact to final response with a consistent, deadline-aware and audit-ready workflow across every team involved.
- Request intake form and identity-verification guidance
- Jurisdiction deadline reference and complexity triage
- RACI and task tracker for cross-functional delivery
- Five adaptable response-letter templates
- DSAR register and fillable audit-readiness checklist
A DSAR process is tested from the outside, on a statutory clock
Requests can arrive through any channel and often span HR, customer service, legal, privacy and IT. Without clear ownership, deadlines, searches and decisions quickly become fragmented.
This toolkit establishes a repeatable lifecycle for access, rectification, erasure, portability, restriction and objection requests, from intake and identity checks through response and record-keeping.
Inside the Toolkit
Seven stages for a defensible DSAR workflow
Recognise the request, protect identity, assign the work and retain the evidence. Fillable templates help teams respond consistently and demonstrate how each decision was reached.
Receive and log
Recognise valid requests through any channel, record every right invoked and start the applicable statutory clock.
Verify identity
Apply proportionate checks that protect the requester without creating an unnecessary barrier or delay.
Triage complexity
Classify scope, risk, systems, exemptions and likely effort so straightforward and contentious requests follow the right path.
Assign the work
Use the included RACI and task tracker to give legal, privacy, HR, customer service and IT clear responsibilities.
Locate and review data
Search relevant systems, preserve an evidence trail, review exemptions and redact third-party information where appropriate.
Respond clearly
Use five adaptable letter templates for acknowledgement, verification, extension, fulfilment and refusal.
Close and evidence
Complete the DSAR register and audit-readiness checklist so every decision remains defensible months later.
Who this is for
Written for teams responsible for receiving, coordinating, reviewing and responding to data subject rights requests.
- Data Protection Officers and privacy teams accountable for deadlines and response quality
- HR and customer service teams that frequently receive requests first
- Legal teams reviewing exemptions, privilege and contentious cases
- IT and security teams locating, extracting and securely delivering personal data
Frequently asked questions
About this toolkit
Which data subject rights does the toolkit cover?
It covers access, rectification, erasure, portability, restriction and objection requests through one consistent intake, triage and response workflow.
Does it include response templates?
Yes. It includes adaptable letters for acknowledgement, identity verification, deadline extension, fulfilment and refusal.
How does it help teams meet deadlines?
The workflow records the applicable jurisdiction, starts the statutory clock, assigns tasks and tracks progress, extensions and final delivery.
Can several departments use the process?
Yes. The included RACI and task tracker clarify responsibilities across privacy, legal, HR, customer service, IT and security.
How is the toolkit delivered?
Complete the form with a business email address and the PDF download link will be provided immediately and sent by email.
Co-produced by Formiti and Privacy360
A complete workflow, delivered or operationalised.
Formiti brings the advisory side: Legal Consultants who interpret the rules, Privacy Architects who convert them into a working governance programme, and Technical Operations engineers who implement the controls. Privacy360 is the platform that operationalises the same building blocks into an audit-ready system of record, connecting DSAR intake, identity checks, assignments, response decisions and evidence to the wider privacy record.
Next step
DSAR delivery, implemented for you
Once you have reviewed the Toolkit, talk to us about establishing a scalable DSAR workflow, clearing request backlogs and maintaining an audit-ready evidence trail.