Implementing GDPR Data Subject Access Request (DSAR) Workflow

When to Use

• When building automated DSAR processing pipelines for GDPR/UK GDPR compliance
• When implementing PII discovery across structured and unstructured data sources
• When creating response templates that satisfy Article 15 disclosure requirements
• When auditing existing DSAR handling for regulatory compliance gaps
• When scaling DSAR processing from manual to automated workflows

Prerequisites

• Python 3.8+ with required dependencies (spacy, presidio-analyzer, jinja2)
• Access to data sources where personal data resides (databases, file shares, logs)
• Understanding of GDPR Article 15 requirements and ICO/EDPB guidance
• Appropriate authorization and data protection officer (DPO) approval
• Test environment with synthetic or anonymized data for validation

Background

GDPR Article 15 - Right of Access

Under GDPR Article 15, data subjects have the right to obtain from the controller:

1. Confirmation that their personal data is being processed
2. A copy of all personal data held about them
3. Supplementary information including:
   • Purposes of processing
   • Categories of personal data
   • Recipients or categories of recipients
   • Retention periods or criteria to determine them
   • Right to rectification, erasure, restriction, or objection
   • Right to lodge a complaint with a supervisory authority
   • Source of the data (if not collected directly from the subject)
   • Existence of automated decision-making, including profiling

Timeline Requirements

• Standard deadline: 1 calendar month from receipt of valid request
• Complex extension: Up to 2 additional months (must notify within first month)
• Clock pause: Permitted when identity verification or clarification is needed
• Format: Electronic form if request made electronically (unless otherwise requested)
• Cost: Free of charge (unless manifestly unfounded/excessive)

ICO/EDPB Guidance Key Points

• No formal format required for DSARs - verbal, written, social media all valid
• Request need not mention "subject access request" or cite Article 15
• Identity verification must be proportionate to the risk
• Exemptions exist for legal privilege, third-party data, trade secrets
• EDPB coordinated enforcement actions cover right of access compliance

Instructions

Step 1: DSAR Intake and Verification

Implement a request intake system that captures the request through any channel, verifies the requester's identity, and starts the compliance clock.

from agent import DSARWorkflowEngine

engine = DSARWorkflowEngine(config_path="dsar_config.json")

# Register a new DSAR
request = engine.register_dsar(
    requester_name="Jane Smith",
    requester_email="jane.smith@example.com",
    request_channel="email",
    request_text="I would like a copy of all personal data you hold about me.",
    identity_docs=["passport_verified"],
)
print(f"DSAR ID: {request['dsar_id']}, Deadline: {request['deadline']}")

Step 2: PII Discovery Across Data Sources

Scan databases, files, and logs using regex patterns and NER to find all personal data associated with the data subject.

from agent import PIIDiscoveryEngine

pii_engine = PIIDiscoveryEngine()

# Scan structured data (database)
db_results = pii_engine.scan_database(
    connection_string="postgresql://user:pass@localhost/appdb",
    search_identifiers={"email": "jane.smith@example.com", "name": "Jane Smith"},
)

# Scan unstructured data (files, logs)
file_results = pii_engine.scan_files(
    directories=["/var/log/app", "/data/exports", "/data/documents"],
    search_identifiers={"email": "jane.smith@example.com", "name": "Jane Smith"},
)

# Scan with NER for contextual PII detection
ner_results = pii_engine.scan_with_ner(
    text_corpus=file_results["raw_text_matches"],
    entity_types=["PERSON", "EMAIL", "PHONE_NUMBER", "LOCATION", "DATE_OF_BIRTH"],
)

all_pii = pii_engine.consolidate_results(db_results, file_results, ner_results)
print(f"Found {all_pii['total_records']} PII records across {all_pii['source_count']} sources")

Step 3: Data Mapping and Classification

Map discovered PII to processing purposes, legal bases, and retention periods as required by Article 15.

from agent import DataMapper

mapper = DataMapper(data_inventory_path="data_inventory.json")

# Map PII to Article 15 categories
mapped_data = mapper.map_to_article15(

…