Got a Data Access Request? Your 30-Day Checklist
Based on Articles 12 and 15 of the GDPR and the EDPB's guidance, consulted on 24 October 2026. General information, not legal advice.
A data subject access request (DSAR) is someone asking: "What personal data do you have about me?" It might arrive by email, contact form or even a social media message. There's no required wording.
The title says "30 days" because that's how most people think of it. The GDPR actually says one month, so don't rely on a fixed day count.
Day 1: log it and start the clock
- Record the date you received it. Article 12 says you must act "without undue delay and in any event within one month of receipt of the request."
- Note who asked, how they asked and what they asked for.
- Acknowledge receipt so the person knows you're on it.
Days 1–5: confirm who's asking
The EDPB's SME guide says you may ask for more information if you have "reasonable doubts" about the person's identity. One example: a request from an email address the customer doesn't usually use.
Don't demand ID by default. Ask only for what you need to be sure.
Days 3–15: find the data
Search everywhere the person's data could be:
- email and shared inboxes,
- customer database or CRM,
- invoicing and accounting tools,
- spreadsheets and shared drives,
- newsletter and marketing tools,
- AI tools or other services you've pasted customer data into.
If you keep a record of your processing, this step is much faster.
Days 10–20: prepare the response
Under Article 15, the person is entitled to a copy of their personal data and to information including:
- the purposes of the processing,
- the categories of data,
- who it's been or will be shared with,
- how long you'll keep it, or how you decide,
- their rights, including to complain to a data protection authority,
- where you got the data, if not from them,
- whether automated decision-making is involved.
The right to a copy "shall not adversely affect the rights and freedoms of others." So remove other people's personal data where needed.
Day 20: decide on fees and extensions
- Fees: the first copy is free. Article 15 allows "a reasonable fee based on administrative costs" for further copies. For a manifestly unfounded or excessive request, you may charge a reasonable fee or refuse, but you must be able to show it was unfounded or excessive.
- Extension: for complex or multiple requests you can extend by two further months. Tell the person, with reasons, within the first month.
Before the month ends: send it
- If the request came electronically, provide the information in a commonly used electronic form, unless they ask otherwise.
- Send it securely.
- If you won't comply, explain why within one month, and tell them they can complain to a supervisory authority and seek a judicial remedy.
After: keep a short log
Record what you received, what you sent and when. If anyone questions it later, that log is your evidence.
Go deeper
The DSAR Response Kit gives you the one-month clock, including when it pauses and when it doesn't, a four-stage workflow, six ready-to-copy templates and a tracking log.
👉 Find it at bookpilot.org/books
Sources
All consulted on 24 October 2026.