# Data Access Request: [Dataset or data product name]

> Request, approval and periodic re-certification record for access to one dataset or data product: who needs access, for what purpose, to which columns and rows, for how long, with which safeguards, who approved it, and when it must be confirmed again or removed. It supports data minimisation, data protection by design and security of processing as set out in GDPR Articles 5(1)(c), 25 and 32 (the same article numbers apply under the UK GDPR), and maps to ISO/IEC 27001:2022 Annex A controls 5.15 and 5.18 and NIST SP 800-53 Rev. 5 controls AC-2 and AC-6. Replace every `[bracketed]` value and every row marked *Example*. Worked examples use Corvid Commerce, a fictional SaaS retailer. This is a documentation format, not legal advice: check the current official texts and your data protection officer's guidance.

<!--
Guidance: How to use this template
- Use one request per requester group, dataset and purpose. A request for "all sales data, for analysis" cannot be assessed; split it.
- The requester fills sections 1 to 4. The data owner, steward and, where personal data is involved, the data protection contact fill section 5. The platform team records provisioning in section 6.
- Prefer the smallest access that meets the purpose: aggregated or masked views before row-level personal data, a time limit before permanent access, a group grant before individual grants.
- Re-certification (section 7) is the step most often skipped. Put the review date in the access tool, so that access expires automatically if nobody confirms it.
- Related documents: Data Classification Policy (`data/data-classification-policy`), Data Catalogue Metadata Standard (`data/data-catalog-metadata-standard`), Data Contract (`data/data-contract`), Data Retention and Deletion Standard (`data/data-retention-deletion-standard`), User Access Review (`ops/access-review`), DPIA (`compliance/dpia`), GDPR Record of Processing Activities (`compliance/gdpr-ropa`).
-->

## Document control

<!-- Guidance: Each request gets an ID from the access tool or ticket system. Keep the record for the retention period your audit policy sets, even after access is removed. -->

| Field | Value |
|---|---|
| Request ID | [DAR-2026-0142] |
| Status | [Submitted / Under review / Approved / Approved with conditions / Rejected / Provisioned / Expired / Revoked] |
| Dataset or product | [Name and catalogue identifier, for example `urn:corvid:dataset:sales:orders`] |
| Classification | [Level from the classification policy] |
| Contains personal data | [Yes / No; categories if yes] |
| Data owner | [@data-owner] |
| Data steward | [@data-steward] |
| Data protection contact | [@dpo-or-privacy-lead] (required when personal data is requested) |
| Submitted | YYYY-MM-DD |
| Access expires | YYYY-MM-DD |
| Next re-certification | YYYY-MM-DD |

## 1. Requester and access group

<!-- Guidance: Name the people or group who will use the data and the accountable manager. Service accounts need a named human owner. -->

| Field | Value |
|---|---|
| Requester | [@name], [team] |
| Accountable manager | [@manager] |
| Access group or role | [Group name in the identity provider] |
| Members (or group size) | [Names or count] |
| Service account, if any | [Account name], owner [@name] |
| Location of users | [Countries, relevant for transfers] |

*Example:* Requester: Growth analytics team, 6 analysts; group `grp-growth-analysts`; accountable manager: head of growth; no service account; all users in the EU.

## 2. Purpose and legal basis

<!-- Guidance: Describe the purpose specifically enough that a reviewer can decide whether each requested column is needed. For personal data, record the lawful basis agreed with the data protection contact and the record of processing entry. Pitfall: "business analysis" as a purpose. -->

| Field | Value |
|---|---|
| Purpose | [What the data will be used for and the decision or product it supports] |
| Expected outputs | [Reports, models, extracts] |
| Lawful basis (personal data) | [Basis under GDPR Article 6, confirmed by the data protection contact] |
| Record of processing entry | [Reference in `compliance/gdpr-ropa`] |
| DPIA required? | [Yes, reference / No, reason] |

*Example:* Purpose: measure 30-day retention of first-time customers by acquisition channel, to decide onboarding experiments. Outputs: weekly retention dashboard; no extracts. Lawful basis: legitimate interests, assessment LIA-031 confirmed by the privacy lead.

## 3. Data requested

<!-- Guidance: List the columns or fields, and justify each personal or sensitive one. Data minimisation (GDPR Article 5(1)(c)) means the reviewer should be able to remove any column that the purpose does not need. -->

| Field or column | Classification | Needed for | Form requested | Reviewer decision |
|---|---|---|---|---|
| `order_id` *(Example)* | Internal | Counting orders | Raw | Approved |
| `customer_id` *(Example)* | Confidential, pseudonymous identifier | Linking first and second orders | Hashed with a project-specific salt | Approved, hashed |
| `customer_email` *(Example)* | Confidential, personal data | Not needed | Not requested | Not applicable |
| `order_total` *(Example)* | Internal | Segmenting by basket size | Raw | Approved |
| `acquisition_channel` *(Example)* | Internal | Breakdown by channel | Raw | Approved |
| `shipping_postcode` *(Example)* | Confidential, personal data | Regional breakdown | Truncated to first two characters | Approved, truncated |
| [Column] | [Level] | [Need] | [Raw / Masked / Aggregated] | [Decision] |

Row scope: [for example "orders from 2025-01-01, EU storefronts only"].

## 4. Duration, environment and handling

<!-- Guidance: Access ends when the purpose ends. State where the data will be processed and whether it may leave the platform. -->

| Field | Value |
|---|---|
| Access type | [Read only / Read and write] |
| Duration | [Start and end date; default 12 months *(Example)*] |
| Environment | [Warehouse workspace, notebook platform] |
| Extracts or downloads | [Not allowed / Allowed to approved location only] |
| Sharing outside the group | [Not allowed / Allowed for aggregated outputs with at least [n] customers per cell] |
| Retention of derived data | [Rule from `data/data-retention-deletion-standard`] |

## 5. Review and approval

<!-- Guidance: The owner decides; the steward checks fit with classification and contracts; the data protection contact reviews personal data requests. Record conditions precisely so they can be provisioned and audited. Segregation of duties: the requester cannot approve their own request. -->

| Check | Result | By |
|---|---|---|
| Purpose specific and legitimate | [Pass / Fail] | Steward |
| Columns limited to the purpose (minimisation) | [Pass / Changes made] | Steward |
| Masking or aggregation applied where possible (protection by design and by default) | [Pass / Changes made] | Steward |
| Personal data basis, DPIA and transfer checks | [Pass / Not applicable] | Data protection contact |
| Security controls of the target environment adequate for the classification | [Pass / Fail] | Security or platform |
| Conflicts with contracts, licences or consent terms | [None / Listed] | Steward |

| Role | Name | Decision | Conditions | Date |
|---|---|---|---|---|
| Data owner | [@name] | [Approve / Approve with conditions / Reject] | [Conditions] | YYYY-MM-DD |
| Data protection contact | [@name] | [Decision] | [Conditions] | YYYY-MM-DD |
| Data steward | [@name] | [Reviewed] | [Notes] | YYYY-MM-DD |

```mermaid
flowchart LR
  A[Request submitted] --> B[Steward review]
  B --> C{Personal data?}
  C -->|yes| D[Data protection review]
  C -->|no| E[Owner decision]
  D --> E
  E -->|approve| F[Provision with conditions]
  E -->|reject| G[Requester informed with reason]
  F --> H[Re-certify before expiry]
  H -->|confirmed| F
  H -->|not confirmed| I[Access removed]
```

## 6. Provisioning record

<!-- Guidance: Record exactly what was granted so that it can be compared with the approval at re-certification. -->

| Field | Value |
|---|---|
| Granted object | [Secure view, policy or table name] |
| Grant | [Role and privilege, for example SELECT on view `growth.v_orders_retention`] |
| Masking or row policies applied | [Policy names] |
| Expiry configured in tool | [Yes, date / No, reason] |
| Provisioned by and date | [@platform-engineer], YYYY-MM-DD |
| Verified by | [@steward], YYYY-MM-DD |

## 7. Re-certification and removal

<!-- Guidance: The owner confirms at a fixed interval that each grant is still needed. Default intervals by classification are an organisation decision; record yours. Unconfirmed access is removed, not extended. -->

| Classification | Re-certification interval *(Example)* |
|---|---|
| Restricted | Every 3 months |
| Confidential | Every 6 months |
| Internal | Every 12 months |

| Cycle | Date | Still needed? | Members changed? | Columns still justified? | Decision | By |
|---|---|---|---|---|---|---|
| 1 *(Example)* | 2027-04-30 | Yes | 1 leaver removed | Yes | Confirmed | Data owner |
| [n] | YYYY-MM-DD | [Yes / No] | [Changes] | [Yes / No] | [Confirm / Reduce / Revoke] | [@name] |

Removal triggers: purpose completed, expiry date reached without re-certification, requester or group no longer needs the data, a change in classification, or a breach of the handling conditions.

## 8. Control mapping and references

<!-- Guidance: Show auditors which requirements this record supports. Article and control numbers only; read the official texts for the requirements. -->

| Section | GDPR (EU) and UK GDPR | ISO/IEC 27001:2022 Annex A | NIST SP 800-53 Rev. 5 (US federal catalogue) |
|---|---|---|---|
| 2, 3 Purpose and minimisation | Art. 5(1)(b) purpose limitation, 5(1)(c) data minimisation | 5.15 Access control | AC-6 Least Privilege |
| 3, 4 Masking, defaults | Art. 25 data protection by design and by default | 5.15 | AC-6 |
| 5, 6 Approval and provisioning | Art. 32 security of processing | 5.18 Access rights | AC-2 Account Management |
| 7 Re-certification and removal | Art. 5(1)(c), 32 | 5.18 | AC-2 |

| Reference | Version or date checked |
|---|---|
| Regulation (EU) 2016/679 (GDPR), Articles 5, 25 and 32 | Official Journal text checked 2026-10-30 |
| UK GDPR, as amended (including by the Data (Use and Access) Act 2025) | Check the current consolidated text at legislation.gov.uk |
| ISO/IEC 27001:2022, Annex A | 2022 edition with Amd 1:2024 |
| NIST SP 800-53 Rev. 5, release 5.2.0 | Checked 2026-10-30 |

## Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR) Articles 5(1)(c), 25 and 32, a public legal act, and on NIST SP 800-53 Rev. 5 (release 5.2.0), a US government publication; article and control numbers are cited and requirements are paraphrased in original words. ISO/IEC 27001:2022 is copyrighted and is cited by control number with short original labels only; no ISO text is reproduced. Official text: ISO, purchase or licensed access: https://www.iso.org/standard/82875.html. The request format, checks, intervals and examples are original, and Corvid Commerce is fictional. This template is original text written for this collection. This is a documentation format, not legal advice: check the current official texts and consult your data protection officer or a qualified professional. Template licence: MIT.