Handle a data subject access request from start to finish
Gives a step-by-step plan, search checklist, exemption review, and response letter for responding to a personal data access request on time.
The prompt
Help me handle a data subject access request (DSAR).
Request (paste or summarize): [TEXT]
Date received: [DATE]
Requester's relationship to us: [customer / employee / ex-employee / other]
Applicable law: [e.g. GDPR, UK GDPR, CCPA/CPRA, other]
Context: [e.g. "ex-employee in a dispute with us", "routine customer request"]
Our systems that may hold their data: [e.g. CRM, HR system, email, support tickets, backups, vendors]
Give me:
1. Timeline - the response deadline and any extension option under the law I named, marked [CONFIRM DEADLINE], with internal milestones.
2. Identity verification - proportionate steps, without asking for more data than needed.
3. Clarifying scope - whether and how I can ask the requester to narrow the request, without delaying the clock improperly.
4. Search plan - systems, custodians, search terms, and date ranges, as a checklist with owners.
5. Review checklist - third-party personal data to redact, privileged material, other possible exemptions to consider [CONFIRM EXEMPTION APPLIES], and whether a dispute or litigation affects how I handle it.
6. Supplementary information to include (purposes, recipients, retention, source, rights, transfers).
7. Response letter - clear, polite, and complete, with placeholders for the data provided.
8. Record of handling - a log template for accountability.
Do not state statutory deadlines or exemptions as settled; flag them for confirmation. A qualified privacy lawyer must review before responding, especially if the request is linked to a dispute.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- TEXT
- DATE
- customer / employee / ex-employee / other
- e.g. GDPR, UK GDPR, CCPA/CPRA, other
- e.g. CRM, HR system, email, support tickets, backups, vendors
- CONFIRM DEADLINE
- CONFIRM EXEMPTION APPLIES
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Write a student conduct decision letter that follows due processDrafts a clear, fair discipline decision letter with findings, policy basis, sanction, and appeal rights.
- Document a best-interest recommendation for a client fileA clear record of why a recommended investment or account suits the client's profile, costs, and reasonably available alternatives.
- Plan the response to a public records or FOIA requestA search plan, exemption review, fee estimate, and response letter for a public records request, built around your statutory deadlines.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.