DSAR Policy Template: Free PDF With GDPR and CCPA Deadlines

A customer success rep forwards an email titled "Request for a copy of my data" to the founder. It is day nine. The one-month GDPR clock started on day one, nobody has checked who actually sent it, and nobody is sure whose job it is.

A DSAR policy template exists for exactly this moment. It is also the answer to a line that keeps appearing in enterprise security questionnaires: "Do you have a documented process for data subject requests?"

A data subject access request (DSAR) policy is the internal document that says how your company recognizes, verifies, searches for, and answers a request from a person who wants to see, correct, or delete the personal data you hold about them, who owns each step, and which deadline applies.

By the end of this guide you will have a free, ungated PDF with real sample clauses, a deadline table for both laws, an identity verification matrix, four response letters, and a request log you can start using today.

Here's what I'll cover:

• What a data subject access request policy is, and what it is not
• Which law your DSAR policy template follows, GDPR or CCPA
• The ten sections every policy needs
• DSAR deadlines side by side
• Intake to closure, including the request form and identity checks
• Fees, refusals, search, and redaction
• Response letters, the request log, and sample clauses
• What SOC 2 and ISO 27701 say, and the evidence auditors sample

This guide is practical information, not legal advice. Have counsel review the final policy before you adopt it.

What Is a Data Subject Access Request Policy, and What Does It Not Cover?

A data subject access request policy is a short internal procedure. It tells your team what to do in the first ten minutes after someone asks for their data, and what to do on every day after that until the request is closed.

It helps to separate four things people mix up. The policy sets the rules and owners. The request form is an optional convenience for the requester. The procedure is the step list your team follows. The log is the record that proves you followed it.

DSAR Policy Template vs Privacy Policy, Breach Procedure, and DSAR Software

Three neighbors sit close to this document. The privacy policy is the public notice that tells people their rights exist and where to send a request. This policy is the internal procedure for answering. A breach procedure is a separate obligation, covered in our GDPR breach notification guide and incident response plan template. DSAR software is a tool, not a policy. For the full list of data subject rights, see GDPR compliance requirements.

GDPR DSAR Policy vs CCPA DSAR Rules: Which Law Your DSAR Policy Template Follows

Does a small company actually receive these requests? Sometimes, and rarely on a schedule. A Hacker News commenter writing in January 2026 noted that for California requests it was "mostly big companies with A LOT of users that got more DSARs". A startup may go a year without one, then receive three in a month after a layoff or a support dispute. The policy has to be ready before the first one lands.

One DSAR policy for startups can serve both laws, as long as it names which clock applies to which requester.

A GDPR DSAR and a CCPA DSAR are not the same thing. The GDPR right of access is one of several rights. California calls the whole family "requests to know, delete, and correct." Your policy should cover the family, not only access, because the first request you receive may be "please delete everything."

The UK sits under its own version of the rules, and the Data (Use and Access) Act 2025 amended UK subject access law, so check the ICO's current guidance for UK requesters. Other US states have their own request rules and deadlines. Confirm the ones that apply to your customers rather than assuming they match California.

Does a DSAR Apply to Employee, Contractor, and Applicant Data?

Yes. People inside the company ask too. Their data sits in your HRIS, email, Slack, and recruiting tool, which are the places startups forget to search. California privacy law now treats employee and job applicant data the same way it treats customer data, as our CCPA compliance guide explains.

What a DSAR Policy Template Must Include

Ten sections cover what a regulator, a customer, or an auditor will look for. Brackets in the PDF mark the values you set for your own company.

The sections work as one lifecycle. A request arrives, the clock starts, you verify, search, redact, answer, and record. Each section answers one question in that chain, and the rest of this guide takes them in order.

DSAR Deadline Rules: GDPR One Month vs CCPA 45 Days

The deadline is the first thing most readers want, so here it is side by side.

Two details catch people. The GDPR period is one month, not a fixed 30 days. And California's 45 days is counted from receipt even if you are still verifying the person, so a slow identity check eats your own time.

Newer California rules on automated decisionmaking technology add a further access right with a later compliance date. If your product makes significant decisions about people with automated tools, review those rules with counsel.

Try this yourself: forward a dummy request to your support inbox from a personal email address and time how long it takes to reach the person who owns it. If the answer is more than a day, your real clock is already running while nobody is looking.

DSAR Procedure in Your DSAR Policy Template: Intake to Closure

This procedure is written for a DSAR policy for startups: one owner, one backup, no committee. Nine steps cover the whole lifecycle.

1. Receive and recognize. Anyone who gets a request forwards it to the owner the same day.
2. Log it. Assign a case ID and record the date received, which is the start of the clock.
3. Acknowledge. Send the acknowledgment letter and say which deadline applies.
4. Verify identity. Use the lightest check that fits the risk.
5. Clarify scope. Ask only what you need to find the data, and only if it is genuinely unclear.
6. Search. Ask each system owner for the requester's data by a set date.
7. Review and redact. Remove other people's data and anything you may withhold.
8. Respond. Send the data and the required information in a commonly used electronic format.
9. Close and retain. Record the outcome, the date sent, and the date the case file is deleted.

Requests do not arrive on a form. They arrive in Slack, a support ticket, a LinkedIn message, or a phone call. The policy should say that any written or spoken request counts, and that your form is a convenience, not a gate.

DSAR Request Form: What to Ask For and What to Leave Out

A DSAR request form helps the requester and speeds up your search. It must never be mandatory, because a valid request does not stop being valid because it arrived in an email.

Fields worth collecting: full name, contact email, relationship to the company (customer, employee, applicant, other), what they want (copy of data, correction, deletion), a date range if they have one, and the format they prefer. Leave out government ID numbers, dates of birth you do not need, and any free-text field that invites medical or financial detail.

DSAR Identity Verification Rules for Your DSAR Policy Template

Verification is where startups either over-collect or under-check. GDPR Article 12(6) allows you to ask for additional information to confirm identity when you have reasonable doubts about who is asking. California's rules (11 CCR 7060) require a documented, reasonable verification method, and tell businesses to avoid collecting extra sensitive information unless it is necessary to verify.

A risk-based matrix keeps the checks proportionate:

The rule behind the matrix is data minimization. Collect the least you need, and delete any ID copy as soon as it has served its purpose. California's regulation says the same thing: new information collected only for verification must be deleted as soon as practical after processing the request.

Fees, Refusals, and Exemptions in Your DSAR Policy Template

Can you charge a fee for a DSAR? Under GDPR Article 12(5), the default answer is no. Information and actions are free of charge. You may charge a reasonable fee or refuse to act only when a request is manifestly unfounded or excessive, and the burden of proving that sits with you, not the requester.

Can you refuse a DSAR? Sometimes. If you decide not to act, Article 12(4) requires you to explain why within one month and to tell the requester they can complain to a supervisory authority and seek a judicial remedy. A refusal letter that skips that sentence is incomplete.

"Excessive" usually means repetitive, not merely large. A big request from someone who has never asked before is still an answerable request.

For California requests, confirm the current denial and fee rules with counsel before you write them into the policy.

Searching and Redacting Personal Data Under Your DSAR Policy Template

Searching is where a DSAR policy for startups earns its keep. The data is rarely in one place. Walk the list before the first request arrives, not during it.

Where a SaaS startup's personal data typically sits:

• Production database: account, profile, and usage records
• Analytics and product tools: events tied to a user ID
• Support tool: tickets, chat transcripts, attachments
• CRM and marketing tools: contact records, email history
• Email and Slack: messages that mention or involve the person
• Logs and backups: often the hardest to search and the easiest to forget
• Vendors and sub-processors: anything they hold on your behalf

A data inventory makes this faster. Our guide to data mapping software covers tools for building one, and the data classification policy helps you decide which systems hold the most sensitive records. For each system, name the person who can search it and the number of working days they have to answer.

Redaction comes next. A copy of the data must not adversely affect the rights and freedoms of others, which is the wording of GDPR Article 15(4). In practice that means removing other people's personal data, and checking whether privileged material or trade secrets need to be withheld.

A Hacker News commenter who says they handled DSARs at one of the big 4 wrote in May 2026 that "we'd redact the names of other people on joint accounts". Practitioners differ on where the legal line sits for third-party names, so treat it as a case-by-case judgment, with counsel for the hard ones, not as a blanket rule.

One more rule belongs in the policy. Do not delete data after a request arrives to avoid answering it. Your data retention policy sets normal deletion schedules, and the DSAR policy should say that a pending request freezes deletion of that person's data until the case is closed.

DSAR Response Letter Wording for Your DSAR Policy Template

A complete response is more than a data export. Article 15 lists the information the requester is entitled to alongside the copy: the purposes of the processing, the categories of data, the recipients, the storage period or the criteria for setting it, the right to request rectification or erasure, the right to complain to a supervisory authority, the source of the data where it was not collected from the person, and the existence of automated decision-making.

If data is transferred to a third country, the requester can also be told which safeguards apply. Electronic requests are answered in a commonly used electronic form unless the requester asks otherwise.

A good approach is to prepare these answers once, in a standard paragraph, and update it when your processing changes.

DSAR Template Letters: Acknowledgment, Extension, Refusal, Fulfilment

Four letters cover almost every case. The full text is in the PDF. Each shell below shows the sentence that cannot be left out.

DSAR Log for Your DSAR Policy Template: Fields That Prove You Met the Deadline

The log is the document that turns a policy into proof. If an auditor, a customer, or a regulator ever asks whether you met a deadline, the log is the answer.

An illustrative row, with fictional data, looks like this: case DSAR-0001, received 3 March, channel support email, requester type ex-employee, regime GDPR, verification confirmed 5 March, no extension, five systems searched, fulfilled, sent 19 March, case file deleted after 24 months.

Four numbers are worth watching: days to acknowledge, the share answered inside your internal target, the number of extensions, and the number of refusals. A rising extension count tells you your search process is too slow. A rising refusal count tells you to check your reasoning.

DSAR Policy Example: Sample Clauses You Can Adapt

Here is what a DSAR policy example looks like as clauses. Brackets mark the values to set for your own company.

DSAR Template Wording for the Support Team Playbook

Front-line staff need a short version they can paste into a help center macro. Treat this as the DSAR template wording for the support team.

DSAR Policy Template Requirements by Framework: SOC 2, ISO 27701, and Privacy Laws

Neither SOC 2 nor ISO 27001 requires a DSAR policy as a standalone document for a startup. The two places where this topic does show up are optional or specialized: the SOC 2 Privacy category and the ISO 27701 privacy extension. Both apply only when they are in scope for your audit.

The SOC 2 and ISO 27701 control wording above is paraphrased from published mappings of those frameworks. Check the exact text in the official criteria or standard before you cite a control in an audit response. If you pursue SOC 2 without the Privacy category, a DSAR policy still helps with customer questionnaires, but your auditor will not test it. See our SOC 2 framework page for how scope is decided.

Do You Need DSAR Software, or Is a Spreadsheet Enough?

A few requests a quarter run fine on a log and a checklist. Volume, many systems, or an enterprise questionnaire that asks for automation is when tooling starts to pay.

What a tool does not replace is the policy, the owner, and the verification rule. Software speeds the search. It cannot decide whether you should answer.

If you are weighing vendors, our best data privacy software and best CCPA compliance software guides compare the options. Start with the policy either way.

Rolling Out Your DSAR Policy Template and Proving It Works

A policy nobody has read is not a control. Rollout is a short sequence:

1. Approve the policy with a version number and a date.
2. Name the owner and the backup.
3. Publish the request channel in your privacy notice and your site footer.
4. Train support, HR, and anyone who reads a shared inbox.
5. Run a test request and record how long it takes.
6. Review annually, and after any incident or change in systems.

DSAR Policy Template Evidence: What Auditors and Customers Sample

Answering Customer Questionnaires About Your DSAR Process

DSAR Policy Template Mistakes to Avoid

These are easy to get wrong, and each one has caused a missed deadline somewhere.

• Counting the clock from when the privacy owner sees the request. It starts on receipt by anyone in the company.
• Requiring a form. A request is valid in any form.
• Asking for ID by default. Verify in proportion to the risk, and collect the minimum.
• Deleting data after a request arrives. It looks like evasion and can be treated as such.
• Keeping a spreadsheet nobody owns. A log without an owner is a list of missed deadlines.
• Handling only access requests. California also covers requests to delete and correct, and your first request may be one of those.

How ComplyJet Helps With Your DSAR Policy Evidence

A DSAR policy is quick to write and tedious to prove. The rules fit on three pages. The proof is a year of consistent behavior.

ComplyJet's policy management drafts policies with AI, lets you edit them before publishing, distributes them to your team, and tracks acknowledgments with a timestamp and a version history. Our security awareness training assigns courses to your team and keeps per-person completion records, and our audit evidence collection keeps those records beside everything else an auditor asks for.

The request itself, the search, and the response live in your own tools. ComplyJet holds the policy, the acknowledgments, and the training evidence.

FAQs

What Should a DSAR Policy Template Include?

Ten sections: purpose and scope, definitions, roles and owners, how to submit, identity verification, deadlines, fees and refusals, search and redaction, response content, and records and review. Add a request form, four response letters, and a log so the policy can be run on day one.

How Long Do You Have to Respond to a DSAR?

Under GDPR Article 12(3), one month from receipt, extendable by up to two further months for complex or numerous requests, with notice and reasons inside the first month. Under California's 11 CCR 7021, confirm receipt within 10 business days and respond within 45 calendar days, with one extension of up to 45 more days and notice to the consumer.

How Do You Verify Identity for a DSAR?

Use the lightest check that fits the risk. For a logged-in user, confirm to the email on file. For others, ask an account-specific question. Collect the minimum, and delete any ID copy once it has served its purpose.

Can You Charge a Fee or Refuse a DSAR?

Under GDPR, requests are free. You may charge a reasonable fee or refuse only when a request is manifestly unfounded or excessive, and you must be able to prove it. A refusal needs reasons and notice of the right to complain and seek a judicial remedy. Confirm California's current rules with counsel.

What Is the Difference Between a GDPR DSAR and a CCPA Consumer Request?

A GDPR DSAR is a request under the right of access, one of several data subject rights. A CCPA consumer request covers three types: know, delete, and correct. The clocks differ: one month for GDPR, 45 calendar days for CCPA.

Who Should Handle DSARs at a Startup?

One named owner and one backup, usually whoever leads security, legal, or operations. Give them authority to ask system owners for data, and make sure every employee knows to forward a request the same day.

Does a DSAR Apply to Employee Data?

Yes. Employees, contractors, and applicants can ask too. Their data sits in HR tools, email, and Slack, which your search checklist should include. California privacy law also treats employee and applicant data as in scope.

Is There a Free DSAR Policy Template?

Yes. The PDF above is free and ungated: a policy, a request form, an identity verification matrix, four response letters, a log, and a search and redaction checklist. Adapt the bracketed values to your company and have counsel review the final version.

Related Reading

• GDPR Compliance Requirements, for the eight data subject rights.
• CCPA Compliance Guide, for California consumer rights.
• GDPR Breach Notification, for the separate breach clock.
• Data Retention Policy, for deletion schedules.
• Incident Response Plan Template, for security incidents.
• Best Data Privacy Software, for the tooling question.
• Best Data Mapping Software, for building a data inventory.

Sources:

• GDPR Article 12, gdpr-info.eu
• GDPR Article 15, gdpr-info.eu
• 11 CCR 7021, Cornell LII
• 11 CCR 7060, Cornell LII