Data Subject Request Procedure Template (GDPR DSAR, CCPA)

Data Subject Request Procedure: [Organization name]

A procedure for receiving, verifying, answering and recording requests from individuals who exercise their data protection rights: access, rectification, erasure, restriction, portability, objection and rights related to automated decisions. Based on the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) Articles 12 to 22 and EDPB Guidelines 01/2022 on the right of access (version 2.0 adopted 28 March 2023, current version 2.1 with minor corrections), with a variant for consumer requests under the California Consumer Privacy Act (Civil Code sections 1798.100 to 1798.199.100, CCPA) and the CCPA Regulations (effective 1 January 2026). Dates and rules were checked on 2026-10-30; check the current official texts before use. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice; check the current official text and a qualified professional.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and roles
2. Rights and regimes covered
3. Intake channels and recognising a request
4. Logging and acknowledgement
5. Identity verification and authorised agents
6. Clarifying scope and searching
7. Deadlines and extensions
8. Exemptions, restrictions and refusals
9. Fulfilling each right
10. Response letters
11. Request log, records and metrics
12. Training, quality checks and review
13. Glossary and references

1. Purpose, scope and roles

This procedure makes sure that every request from an individual about their personal data is recognised, verified, answered within the legal time limit, and recorded, and that refusals are justified and reviewed.

It applies to all staff, contractors and processors who may receive a request through any channel, and to all personal data held by [Organization] as controller (GDPR) or business (CCPA).

2. Rights and regimes covered

2.1 EU GDPR and UK GDPR

The UK GDPR keeps the same article numbering. The Data (Use and Access) Act 2025 amends the UK rules on subject access, including a statutory basis for limiting searches to what is reasonable and proportionate and for pausing the time limit while the controller waits for clarification. Check on legislation.gov.uk and in the ICO guidance which of these provisions are in force on the date you handle a request.

2.2 CCPA variant (California)

Other US state privacy laws give similar rights with different deadlines and appeal processes. List each one that applies to you in an extra column of section 7.

3. Intake channels and recognising a request

3.1 Channels

Under the CCPA Regulations, a business that operates only online and has a direct relationship with the consumer may offer an email address alone for requests to delete, correct and know; other businesses offer two or more methods, one of them a toll-free number, and a website method if they have a website. If a consumer uses another method, either treat the request as received or explain how to submit it.

3.2 Recognising a request

A message is a data protection request when the person asks, in any words, to see, copy, correct, delete, move or stop using personal data about them, or objects to how it is used. The person does not need to name the law, use the word "request" or give reasons. When in doubt, treat it as a request and log it.

Requests that look like data protection requests but follow other rules, such as a request for documents in litigation or a freedom of information request to a public body, are logged and routed to [legal counsel] for a decision on which rules apply.

4. Logging and acknowledgement

Log every request within [1] working day of receipt with the fields in section 11. Then send an acknowledgement (letter L1 in section 10) that states the request received, what happens next, whether identity information is needed, and the date by which a response is due.

5. Identity verification and authorised agents

5.1 Verification levels

GDPR rule: ask for additional information only where you have reasonable doubts about the requester's identity (Art. 12(6)), and only what is necessary. Where you cannot identify the person at all, explain that (Art. 11(2) and 12(2)). According to the EDPB guidelines, the time limit may be suspended while you wait for identity information you asked for without undue delay.

CCPA rule: match identifying information to data already held before asking for more; a reasonable degree of certainty for categories, a reasonably high degree of certainty for specific pieces, which may include three data points and a signed declaration under penalty of perjury (Regulations sections 7060 to 7062). The 45-day period runs from receipt whatever time verification takes. Do not require verification for opt-out of sale or sharing and for requests to limit.

5.2 Authorised agents and representatives

6. Clarifying scope and searching

6.1 Clarifying the request

Ask the requester to specify the information or processing their request relates to only when you process a large quantity of information about them (GDPR Recital 63), and do not use clarification to delay or narrow a request the person did not want narrowed. Without a reply, answer the request as made.

6.2 Search plan

Freeze the data at the time of the search where possible: do not delete or change data because a request has arrived, and do not delay routine deletion only to avoid answering. Note the search date in the log.

7. Deadlines and extensions

7.1 Rules

How to count a GDPR month, following EDPB Guidelines 01/2022 and Regulation (EEC, Euratom) No 1182/71: the period ends on the same date in the following month; where that date does not exist, on the last day of that month; where the last day falls on a weekend or public holiday, on the next working day.

7.2 Worked due dates

Set internal milestones: search complete by day [10], draft response by day [20], DPO review by day [25] of the one-month period.

8. Exemptions, restrictions and refusals

8.1 Grounds to consider

8.2 Refusal record

9. Fulfilling each right

9.1 Access (GDPR Art. 15)

• Confirm whether personal data about the person is processed.
• Provide a copy of the personal data, in a commonly used electronic form if the request was electronic, unless the person asked otherwise (Art. 15(3)).
• Provide the processing information: purposes; categories of data; recipients or categories of recipients; retention period or criteria; the rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; the source where data was not collected from the person; and the existence of automated decision-making with meaningful information about the logic and consequences (Art. 15(1)(a) to (h)).
• Describe safeguards for transfers to third countries (Art. 15(2)).
• Redact third-party data where Art. 15(4) applies and record why.
• Explain codes and abbreviations so the copy is intelligible.
• Send through a secure channel; protect files with a password sent separately.

9.2 Rectification, erasure and restriction (Art. 16 to 19)

• Check the ground or accuracy claim; for disputed accuracy, restrict processing while checking (Art. 18(1)(a)).
• Correct, erase or restrict in every system in the search plan, including processors.
• For erasure of data made public, take reasonable steps to inform other controllers processing it (Art. 17(2)).
• Notify recipients under Art. 19 unless impossible or disproportionate; tell the person who they are if asked.
• Keep a minimal suppression record (for example a hashed email) where needed to honour the request in future, and say so in the response.
• Backups: record when the data will age out of backups and that it will not be restored into live use.

9.3 Portability (Art. 20)

• Confirm the basis is consent or contract and processing is automated.
• Export data the person provided, including observed data such as activity logs, in a structured, machine-readable format such as JSON or CSV.
• Transmit directly to another controller where technically feasible and requested.

9.4 Objection and automated decisions (Art. 21 and 22)

• Direct marketing objection: stop at once, across all channels.
• Other objections: stop unless compelling legitimate grounds that override the person's interests exist, or the data is needed for legal claims; document the balancing (link the legitimate interests assessment).
• Automated decisions: offer human review by a person with authority to change the outcome, let the person give their view, and record the result.

9.5 CCPA requests

• Know: disclose categories or specific pieces for the period required, in a portable and readily usable format for specific pieces; never disclose the data listed in Regulations section 7024(d).
• Delete: delete from live systems, deidentify or aggregate; tell service providers, contractors and, where relevant, third parties to whom data was sold or shared; record any exception relied on.
• Correct: consider the totality of the information, document the decision, and tell the consumer whether the correction was made.
• Opt-out and limit: act within 15 business days and honour opt-out preference signals as the regulations require.
• Explain the right to complain and any appeal process you offer.

10. Response letters

Example L3 extension notice:

Dear [Name],

We received your request to delete your personal data on 10 February 2026 (reference DSR-2026-0027). Your account is linked to orders, warranty records and marketplace accounts held in four separate systems, and two of our service providers hold copies. We need more time to complete the deletion safely, so we are extending the deadline as the GDPR allows (Article 12(3)). You will receive our answer by 11 May 2026 at the latest, and sooner if we can.

If you are not satisfied with how we handle your request, you can contact our data protection officer at [contact], complain to [supervisory authority] or seek a judicial remedy.

[Name], Privacy team, Quillmoor Homewares Ltd

11. Request log, records and metrics

11.1 Log fields

Retain the log for [period]; the CCPA Regulations require records of requests and responses for at least 24 months (section 7101). Businesses that handle the personal information of 10,000,000 or more consumers in a calendar year also compile and disclose yearly request metrics (section 7102).

11.2 Metrics

12. Training, quality checks and review

• Train customer-facing staff at onboarding and yearly to recognise and forward requests.
• The DPO samples [10%] of closed requests each quarter for completeness, timeliness, redaction quality and tone, and records findings.
• Review the procedure yearly, after a complaint or regulator inquiry, after a significant system change, and when a law, regulation or EDPB or ICO guidance changes.
• Report metrics and sample findings to the management review.

13. Glossary and references

13.1 Glossary

13.2 References

Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR) as published in the Official Journal of the European Union, EDPB Guidelines 01/2022 version 2.1, the California Consumer Privacy Act (Civil Code section 1798.100 and following) and the CCPA Regulations effective 1 January 2026. Articles, sections and time limits are cited and summarised in original wording; no legal text is reproduced beyond short references. Laws, regulations and guidance change: check the current official texts at https://eur-lex.europa.eu/eli/reg/2016/679/oj, https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en, https://leginfo.legislature.ca.gov and https://cppa.ca.gov/regulations/ before use. This is a documentation format, not legal advice; check the current official text and a qualified professional. Template licence: MIT.