The DSAR Toolkit

Handle data subject requests end to end: intake, identity verification, triage, workflow, response letters and an audit-ready register.

A practical guide to the full request lifecycle across all six rights, with jurisdiction deadlines, a RACI tracker and five ready-to-adapt letter templates.

Get the Toolkit

A DSAR tests your programme from the outside, on a statutory clock.

A request is valid the moment someone makes clear what they want, through any channel. The clock starts on receipt, not when the request is logged or identity is verified.

Treating every request as a simple access request is where quality breaks down. This toolkit separates the six rights, sets out triage and task ownership, and gives you the letters and register to evidence each response.

What's inside the 22-page toolkit?

  • DSAR fundamentals

    The six request types and common exemptions to know before triage.

  • Deadlines by jurisdiction

    A working reference for response timelines across major regimes.

  • Intake and verification

    Fillable request form and proportionate identity verification guidance.

  • Triage and workflow

    Complexity triage plus a fillable RACI and task tracker.

  • Five letter templates

    Acknowledgement, verification request, extension, fulfilment and refusal.

  • Register and audit checklist

    DSAR register fields, reporting and a one-page audit readiness checklist.

Who is this toolkit for?

  • DPOs and privacy leads
  • HR teams
  • Customer service teams
  • Legal reviewers
  • IT and security teams

Frequently asked questions

Which request types does it cover?
Access, rectification, erasure, portability, restriction and objection.
Does it include response letters?
Yes. Five templates cover acknowledgement, identity verification, extension, fulfilment and refusal.
Is the deadlines table legal advice?
No. It is a working reference. Confirm the current position for any jurisdiction in play before relying on it for a live request.
Does it work for multi-entity groups?
Yes. It is written for a single team handling a few requests a year and for groups handling requests at volume across several countries.
Do we need Privacy360?
No. Everything is implementable with a spreadsheet, shared drive and the templates provided.

Get the Toolkit

Complete the download form to receive the DSAR Toolkit.