DSAR Compliance Form – Follow My Link

This form should be completed by the person within the organisation who is responsible for responding to Data Subject Access Requests.

A copy of this form will automatically be sent to SDC HR.

Name of organisation:

Name of Data Subject

Name of person completing this form:

Email address of person completing this form: *

Date DSAR Received

Ordinary Deadline Date for Response:

+ 1 Calendar Month from Date DSAR Received

Two Month extension Deadline Date for Response:

+ 3 Calendar Months from Date DSAR Received

Validation

Are we certain the DSAR comes from the Data Subject?

Yes, it comes from the same email we have on file for the data subject
Yes, it comes from the same physical address we have on file for the data subject
Yes, it comes from someone with Power of Attorney for the data subject and we recognise this person
No, we do not recognise the email address or physical address provided

If ‘No’, then the identify of the person making the DSAR must be checked to ensure it is the Data Subject.

Data Assets

What Data Assets of the organisation need to be searched?

If ‘Other’ is selected give details below:

Details of any Other Data Asset to be searched:

Search Criteria

Details of any Other Search Criteria identified in DSAR:

List the Search Terms to be used:

Example: ‘John Smith’, ‘J Smith’, ‘John S’, ‘jsmith@organation.co.uk’.

Search From Date:

Enter the date from which data is to be searched

Search To Date:

Enter the date up to which data is to be searched

Redaction

Will the search results have to be redacted?

Yes, because they will include personal data of other data subjects
Yes, because they will include sensitive personal data of other data subjects
Yes, because they will include confidential or sensitive information that is not personal data
No, because the Data Assets searched against the Search Criteria only contain the Data Subject’s personal data

Volume of Data

How many records are likely to result from the data search?

Less than 50 records
Between 50 and 150 records
Between 150 and 500 records
More than 500 records

Data Processors

Has the organisation used any third party Data Processors?

Yes, the Data Subject’s personal data has been processed by a third party
No, the Data Subject’s personal data has not been processed by a third party

If ‘Yes’ go on to answer the next question

Will it be necessary to require the third party Data Processor to search its Data Assets?

Yes, because without this personal data of the Data Subject may be missed out
No, because the same Personal Data will result from the search of the organisation’s Data Assets

If ‘Yes’ go on to identify all relevant Data Processors

Identify Data Processors who will be required to search for Personal Data:

Will it be feasible to complete this process within 1 calendar month?

If ‘No’ answer the question below and write to the Data Subject claiming the 2 month extension

Why will it not be feasible to complete this process within 1 calendar month?

The volume of data produced by the search will be more than 500 records
The data produced by the search will require scanning or copying of a large volume of hard copy records
The results of the search will include others’ personal data and / or confidential information and require redaction
Third party processors will have to be involved in the process
Resources available for this work re limited due to the size of the organisation
Other reason

If ‘Other reason’ is selected, complete the field below

Details of other reason/s why it will not be feasible to complete this process within 1 calendar month

Has or will a letter be sent to the Data Subject claiming the 2 month extension?

Has the person within the organisation with responsibility for DSARs diarised the relevant deadline date?

DSAR Plan

If necessary note the action points to be taken to search for personal data and collate the results.

Message

This template letter can be used to acknowledge receipt of a DSAR.

If the two month extension is required this template letter can be used to notify the Data Subject of this.

Privacy Notices
Data in this form is processed by SDC HR as an article 28 GDPR processor to the organisation above. As such SDC HR is a data processor and the data controller is the organisation in question, which should ensure that this processing activity is reflected in its privacy notice/s.