GDPR DSAR Response Checklist for Small Businesses (2026)

• ☐
  Log the request Record the date received, requester's name, email, and what they've asked for
• ☐
  Set the deadline Calculate one calendar month from receipt (not working days)
• ☐
  Acknowledge receipt Send a brief confirmation that you've received the request
• ☐
  Verify identity where needed Where you have reasonable doubts, confirm the requester's identity using proportionate checks before releasing personal data
• ☐
  Assess the request Is it clear? Do you need to ask for clarification?

• ☐
  Search email systems Search for emails to/from/about the data subject
• ☐
  Search CRM/database Customer records, contact details, purchase history
• ☐
  Check HR systems If employee request: personnel files, payroll, performance records
• ☐
  Check shared drives Documents, spreadsheets, presentations mentioning them
• ☐
  Check third-party systems Marketing platforms, payment processors, support systems
• ☐
  Check paper files Physical documents, signed forms, printed correspondence

• ☐
  Identify third-party data Names, emails, phone numbers of other people in documents
• ☐
  Redact permanently Use proper redaction tools — not just highlighting or white boxes
• ☐
  Check metadata Remove hidden data in documents (author names, track changes)
• ☐
  Review redactions Have a second person check the redacted documents

Read the full redaction guide →

• ☐
  Prepare cover letter Explain what data you're providing and required GDPR disclosures
• ☐
  Include processing information Purpose, legal basis, recipients, retention period, rights
• ☐
  Compile response package Cover letter + all relevant personal data documents
• ☐
  Final review Check everything is complete and correctly redacted
• ☐
  Send securely Encrypted email, secure portal, or tracked post

• ☐
  Save the original request Keep the email/form with timestamp
• ☐
  Document identity verification How you confirmed who the requester was
• ☐
  Log search activities What systems were searched, when, by whom
• ☐
  Keep redaction records What was redacted and why
• ☐
  Save response copy Copy of everything you sent with date/time
• ☐
  Retain for a documented period Keep records for a period appropriate to your circumstances and document your reason — many organisations keep them up to 6 years to cover the limitation period for legal claims

See a sample evidence pack →