Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging. Covers ICO/EDPB guidance compliance, exemption handling, and scalable batch processing. Use when building or auditing DSAR response capabilities under GDPR/UK GDPR.
Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging. Covers ICO/EDPB guidance compliance, exemption handling, and scalable batch processing. Use when building or auditing DSAR response capabilities under GDPR/UK GDPR.
Implementing GDPR Data Subject Access Request (DSAR) Workflow
When to Use
When building automated DSAR processing pipelines for GDPR/UK GDPR compliance
When implementing PII discovery across structured and unstructured data sources
When creating response templates that satisfy Article 15 disclosure requirements
When auditing existing DSAR handling for regulatory compliance gaps
When scaling DSAR processing from manual to automated workflows
Prerequisites
Python 3.8+ with required dependencies (spacy, presidio-analyzer, jinja2)
Access to data sources where personal data resides (databases, file shares, logs)
Understanding of GDPR Article 15 requirements and ICO/EDPB guidance
Appropriate authorization and data protection officer (DPO) approval
Test environment with synthetic or anonymized data for validation
Background
GDPR Article 15 - Right of Access
Under GDPR Article 15, data subjects have the right to obtain from the controller:
Confirmation that their personal data is being processed
A copy of all personal data held about them
Supplementary information including:
Purposes of processing
Categories of personal data
Recipients or categories of recipients
Retention periods or criteria to determine them
Right to rectification, erasure, restriction, or objection
Right to lodge a complaint with a supervisory authority
Source of the data (if not collected directly from the subject)
Existence of automated decision-making, including profiling
Timeline Requirements
Standard deadline: 1 calendar month from receipt of valid request
Complex extension: Up to 2 additional months (must notify within first month)
Clock pause: Permitted when identity verification or clarification is needed
Format: Electronic form if request made electronically (unless otherwise requested)
Cost: Free of charge (unless manifestly unfounded/excessive)
ICO/EDPB Guidance Key Points
No formal format required for DSARs - verbal, written, social media all valid
Request need not mention "subject access request" or cite Article 15
Identity verification must be proportionate to the risk
Exemptions exist for legal privilege, third-party data, trade secrets
EDPB coordinated enforcement actions cover right of access compliance
Instructions
Step 1: DSAR Intake and Verification
Implement a request intake system that captures the request through any channel,
verifies the requester's identity, and starts the compliance clock.
from agent import DSARWorkflowEngine
engine = DSARWorkflowEngine(config_path="dsar_config.json")
# Register a new DSAR
request = engine.register_dsar(
requester_name="Jane Smith",
requester_email="jane.smith@example.com",
request_channel="email",
request_text="I would like a copy of all personal data you hold about me.",
identity_docs=["passport_verified"],
)
print(f"DSAR ID: {request['dsar_id']}, Deadline: {request['deadline']}")
Step 2: PII Discovery Across Data Sources
Scan databases, files, and logs using regex patterns and NER to find all
personal data associated with the data subject.
from agent import PIIDiscoveryEngine
pii_engine = PIIDiscoveryEngine()
# Scan structured data (database)
db_results = pii_engine.scan_database(
connection_string="postgresql://user:pass@localhost/appdb",
search_identifiers={"email": "jane.smith@example.com", "name": "Jane Smith"},
)
# Scan unstructured data (files, logs)
file_results = pii_engine.scan_files(
directories=["/var/log/app", "/data/exports", "/data/documents"],
search_identifiers={"email": "jane.smith@example.com", "name": "Jane Smith"},
)
# Scan with NER for contextual PII detection
ner_results = pii_engine.scan_with_ner(
text_corpus=file_results["raw_text_matches"],
entity_types=["PERSON", "EMAIL", "PHONE_NUMBER", "LOCATION", "DATE_OF_BIRTH"],
)
all_pii = pii_engine.consolidate_results(db_results, file_results, ner_results)
print(f"Found {all_pii['total_records']} PII records across {all_pii['source_count']} sources")
Step 3: Data Mapping and Classification
Map discovered PII to processing purposes, legal bases, and retention periods
as required by Article 15.
from agent import DataMapper
mapper = DataMapper(data_inventory_path="data_inventory.json")
# Map PII to Article 15 categories
mapped_data = mapper.map_to_article15(
pii_records=all_pii,
data_subject_id="jane.smith@example.com",
)
# Output includes processing purposes, recipients, retention for each data categoryfor category in mapped_data["categories"]:
print(f"Category: {category['name']}")
print(f" Purpose: {category['processing_purpose']}")
print(f" Legal basis: {category['legal_basis']}")
print(f" Retention: {category['retention_period']}")
print(f" Recipients: {', '.join(category['recipients'])}")
Step 4: Exemption Review
Apply exemptions where lawful (third-party data, legal privilege, trade secrets)
before compiling the response.
