GDPR Data Request Template
How it works
GDPR grants EU data subjects rights to access, correct, delete, and port their personal data. The GDPR Data Request Template generates forms and acknowledgment letters for processing Subject Access Requests (SARs), deletion requests, and data portability requests.
**GDPR data subject rights** Article 15 (Right of Access): data subject can request confirmation of whether their data is processed and a copy of that data. Article 16 (Right of Rectification): correction of inaccurate personal data. Article 17 (Right to Erasure / "Right to be Forgotten"): deletion of data when no longer necessary for original purpose, consent withdrawn, or unlawful processing. Article 18 (Right to Restriction): halt processing in certain circumstances. Article 20 (Right to Portability): data provided in machine-readable format for transfer to another controller.
**Response timelines** You must respond to SARs within one calendar month. Complex requests may be extended by two additional months with notice. Failure to respond or unlawful refusal can result in ICO (UK) or supervisory authority complaints and fines.
**Exemptions** The right to erasure does not apply when processing is: necessary for exercising freedom of expression; necessary for legal compliance; in the public interest in health; for archiving in the public interest; for legal claims. Document exemptions applied.
**Identity verification** Before fulfilling a SAR, verify the identity of the requestor to prevent unauthorized disclosure. Request reasonable verification (email confirmation, government ID for sensitive categories) — don't make verification so burdensome it effectively blocks the right.
This tool generates template forms and letters. Organizations processing EU data should have a qualified Data Protection Officer (DPO) or privacy counsel review their SAR processes.
Frequently Asked Questions
- GDPR grants eight data subject rights: right of access (get a copy of data held), right to rectification (correct inaccurate data), right to erasure ('right to be forgotten'), right to restriction of processing, right to data portability (receive data in machine-readable format), right to object to processing, rights related to automated decision-making, and right not to be subject to solely automated decisions with significant effects. Organizations must respond to requests within one month.
- One month from receipt of the request. This can be extended by two additional months for complex or numerous requests, but you must notify the individual within the first month that an extension is needed and why. The clock starts when you receive the request, not when you verify identity. Failing to respond within the deadline is itself a GDPR violation, regardless of whether you ultimately fulfill the request.
- Generally no — responses must be free. Exceptions: if requests are 'manifestly unfounded or excessive,' particularly due to their repetitive character, you can charge a reasonable fee or refuse to respond. 'Excessive' is a high bar — you must demonstrate the burden. Keep records of requests and responses to document patterns of abuse. For the vast majority of single requests from individuals, fees are not permitted.
- A complete DSAR response includes: confirmation whether you process the person's data, a copy of all personal data held (in all systems — CRM, email, analytics, backups), the purposes of processing, categories of data, recipients or categories of recipients, retention period, information about rights (rectification, erasure, restriction, portability, objection), the right to lodge a complaint with a supervisory authority, source of the data (if not collected directly), and any automated decision-making logic.