Data Access Request: [Dataset or data product name]
Request, approval and periodic re-certification record for access to one dataset or data product: who needs access, for what purpose, to which columns and rows, for how long, with which safeguards, who approved it, and when it must be confirmed again or removed. It supports data minimisation, data protection by design and security of processing as set out in GDPR Articles 5(1)(c), 25 and 32 (the same article numbers apply under the UK GDPR), and maps to ISO/IEC 27001:2022 Annex A controls 5.15 and 5.18 and NIST SP 800-53 Rev. 5 controls AC-2 and AC-6. Replace every [bracketed] value and every row marked Example. Worked examples use Corvid Commerce, a fictional SaaS retailer. This is a documentation format, not legal advice: check the current official texts and your data protection officer's guidance.
Document control
| Field | Value |
|---|
| Request ID | [DAR-2026-0142] |
| Status | [Submitted / Under review / Approved / Approved with conditions / Rejected / Provisioned / Expired / Revoked] |
| Dataset or product | [Name and catalogue identifier, for example urn:corvid:dataset:sales:orders] |
| Classification | [Level from the classification policy] |
| Contains personal data | [Yes / No; categories if yes] |
| Data owner | [@data-owner] |
| Data steward | [@data-steward] |
| Data protection contact | [@dpo-or-privacy-lead] (required when personal data is requested) |
| Submitted | YYYY-MM-DD |
| Access expires | YYYY-MM-DD |
| Next re-certification | YYYY-MM-DD |
1. Requester and access group
| Field | Value |
|---|
| Requester | [@name], [team] |
| Accountable manager | [@manager] |
| Access group or role | [Group name in the identity provider] |
| Members (or group size) | [Names or count] |
| Service account, if any | [Account name], owner [@name] |
| Location of users | [Countries, relevant for transfers] |
Example: Requester: Growth analytics team, 6 analysts; group grp-growth-analysts; accountable manager: head of growth; no service account; all users in the EU.
2. Purpose and legal basis
| Field | Value |
|---|
| Purpose | [What the data will be used for and the decision or product it supports] |
| Expected outputs | [Reports, models, extracts] |
| Lawful basis (personal data) | [Basis under GDPR Article 6, confirmed by the data protection contact] |
| Record of processing entry | [Reference in compliance/gdpr-ropa] |
| DPIA required? | [Yes, reference / No, reason] |
Example: Purpose: measure 30-day retention of first-time customers by acquisition channel, to decide onboarding experiments. Outputs: weekly retention dashboard; no extracts. Lawful basis: legitimate interests, assessment LIA-031 confirmed by the privacy lead.
3. Data requested
| Field or column | Classification | Needed for | Form requested | Reviewer decision |
|---|
order_id (Example) | Internal | Counting orders | Raw | Approved |
customer_id (Example) | Confidential, pseudonymous identifier | Linking first and second orders | Hashed with a project-specific salt | Approved, hashed |
customer_email (Example) | Confidential, personal data | Not needed | Not requested | Not applicable |
order_total (Example) | Internal | Segmenting by basket size | Raw | Approved |
acquisition_channel (Example) | Internal | Breakdown by channel | Raw | Approved |
shipping_postcode (Example) | Confidential, personal data | Regional breakdown | Truncated to first two characters | Approved, truncated |
| [Column] | [Level] | [Need] | [Raw / Masked / Aggregated] | [Decision] |
Row scope: [for example "orders from 2025-01-01, EU storefronts only"].
4. Duration, environment and handling
| Field | Value |
|---|
| Access type | [Read only / Read and write] |
| Duration | [Start and end date; default 12 months (Example)] |
| Environment | [Warehouse workspace, notebook platform] |
| Extracts or downloads | [Not allowed / Allowed to approved location only] |
| Sharing outside the group | [Not allowed / Allowed for aggregated outputs with at least [n] customers per cell] |
| Retention of derived data | [Rule from data/data-retention-deletion-standard] |
5. Review and approval
| Check | Result | By |
|---|
| Purpose specific and legitimate | [Pass / Fail] | Steward |
| Columns limited to the purpose (minimisation) | [Pass / Changes made] | Steward |
| Masking or aggregation applied where possible (protection by design and by default) | [Pass / Changes made] | Steward |
| Personal data basis, DPIA and transfer checks | [Pass / Not applicable] | Data protection contact |
| Security controls of the target environment adequate for the classification | [Pass / Fail] | Security or platform |
| Conflicts with contracts, licences or consent terms | [None / Listed] | Steward |
| Role | Name | Decision | Conditions | Date |
|---|
| Data owner | [@name] | [Approve / Approve with conditions / Reject] | [Conditions] | YYYY-MM-DD |
| Data protection contact | [@name] | [Decision] | [Conditions] | YYYY-MM-DD |
| Data steward | [@name] | [Reviewed] | [Notes] | YYYY-MM-DD |
6. Provisioning record
| Field | Value |
|---|
| Granted object | [Secure view, policy or table name] |
| Grant | [Role and privilege, for example SELECT on view growth.v_orders_retention] |
| Masking or row policies applied | [Policy names] |
| Expiry configured in tool | [Yes, date / No, reason] |
| Provisioned by and date | [@platform-engineer], YYYY-MM-DD |
| Verified by | [@steward], YYYY-MM-DD |
7. Re-certification and removal
| Classification | Re-certification interval (Example) |
|---|
| Restricted | Every 3 months |
| Confidential | Every 6 months |
| Internal | Every 12 months |
| Cycle | Date | Still needed? | Members changed? | Columns still justified? | Decision | By |
|---|
| 1 (Example) | 2027-04-30 | Yes | 1 leaver removed | Yes | Confirmed | Data owner |
| [n] | YYYY-MM-DD | [Yes / No] | [Changes] | [Yes / No] | [Confirm / Reduce / Revoke] | [@name] |
Removal triggers: purpose completed, expiry date reached without re-certification, requester or group no longer needs the data, a change in classification, or a breach of the handling conditions.
8. Control mapping and references
| Section | GDPR (EU) and UK GDPR | ISO/IEC 27001:2022 Annex A | NIST SP 800-53 Rev. 5 (US federal catalogue) |
|---|
| 2, 3 Purpose and minimisation | Art. 5(1)(b) purpose limitation, 5(1)(c) data minimisation | 5.15 Access control | AC-6 Least Privilege |
| 3, 4 Masking, defaults | Art. 25 data protection by design and by default | 5.15 | AC-6 |
| 5, 6 Approval and provisioning | Art. 32 security of processing | 5.18 Access rights | AC-2 Account Management |
| 7 Re-certification and removal | Art. 5(1)(c), 32 | 5.18 | AC-2 |
| Reference | Version or date checked |
|---|
| Regulation (EU) 2016/679 (GDPR), Articles 5, 25 and 32 | Official Journal text checked 2026-10-30 |
| UK GDPR, as amended (including by the Data (Use and Access) Act 2025) | Check the current consolidated text at legislation.gov.uk |
| ISO/IEC 27001:2022, Annex A | 2022 edition with Amd 1:2024 |
| NIST SP 800-53 Rev. 5, release 5.2.0 | Checked 2026-10-30 |
Standard and licence note
Based on Regulation (EU) 2016/679 (GDPR) Articles 5(1)(c), 25 and 32, a public legal act, and on NIST SP 800-53 Rev. 5 (release 5.2.0), a US government publication; article and control numbers are cited and requirements are paraphrased in original words. ISO/IEC 27001:2022 is copyrighted and is cited by control number with short original labels only; no ISO text is reproduced. Official text: ISO, purchase or licensed access: https://www.iso.org/standard/82875.html. The request format, checks, intervals and examples are original, and Corvid Commerce is fictional. This template is original text written for this collection. This is a documentation format, not legal advice: check the current official texts and consult your data protection officer or a qualified professional. Template licence: MIT.