Generate a GDPR data subject request response checklist

This generator turns an access, deletion, or portability request type into a practical response checklist. It identifies the common operational steps, adds actions specific to the selected right, and states the standard response period and extension notice to track. The result is a planning aid, not legal advice or a substitute for reviewing the request's facts and applicable law.

Start the clock and establish control

Begin by recording the date the organization received the request, the channel used, the right invoked, and the person responsible for the response. The standard GDPR target is to respond without undue delay and within one calendar month of receipt. A request may arrive through an unexpected channel or without using legal terminology, so teams should train customer support, human resources, and other likely recipients to recognize and route it. Confirm identity proportionately, especially where disclosure or deletion could create harm, but do not demand unnecessary documents by default. If an authorized representative acts for the data subject, verify the authority as well as the relevant identity. Clarify ambiguous scope promptly and document what was agreed. Keep the deadline visible even while questions are being resolved. For complex or multiple requests, an extension of up to two additional months may be available when necessary, but the data subject must be told within the initial month and given reasons. Track that notice as its own task rather than assuming the final deadline alone is sufficient. Record every calculation and decision so another reviewer can reconstruct the timeline.

Search, assess, and apply the selected right

Build a search plan that covers the systems, processors, archives, mailboxes, business teams, and account identifiers reasonably likely to contain personal data in scope. Document both successful searches and places checked with no results. The selected right then changes the substantive work. For access, compile the personal data and the supplementary information required for a meaningful response, while protecting the rights and freedoms of other people. For deletion, identify the applicable ground for erasure and test whether a legal obligation, legal claims, freedom of expression, public interest, or another exception requires continued processing. Where deletion is required, address active systems, downstream workflows, processors, and defensibly controlled retained copies. For portability, separate eligible data provided by the data subject and processed by automated means on consent or contract from data outside the right. Produce eligible data in a structured, commonly used, machine-readable form, and assess direct transmission when requested and technically feasible. Across all three paths, avoid treating the checklist as an automatic legal conclusion: exemptions, sector rules, litigation holds, and local guidance may alter the correct action. Escalate uncertain decisions to the appropriate privacy or legal owner.

Review, deliver securely, and close the record

Before responding, review the package against the original request and the documented scope. Confirm that the correct person's data is included, that unnecessary personal data is excluded, and that third-party information has been handled proportionately. Check the response language: it should clearly say what action was taken, identify any limitation or refusal, give reasons where required, and explain relevant complaint and judicial-remedy rights. If the organization considers a request manifestly unfounded or excessive, the decision to refuse or charge should receive appropriate review and must still be communicated within the applicable initial period. Choose a delivery method that matches the sensitivity of the material. An export containing identity documents, communications, or account history should not be attached casually to an unverified address. Validate destination details for direct portability transfers and retain evidence of delivery. Finally, record the response date, approver, delivery method, data sources searched, exceptions applied, processor or recipient notifications, and any follow-up commitment. Use the generated list as a repeatable control, then adapt it to organizational policy and the request's facts. At $0.002 per API request, it can also support consistent intake workflows without replacing professional judgment.