# Handle a data subject access request from start to finish

Gives a step-by-step plan, search checklist, exemption review, and response letter for responding to a personal data access request on time.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, HR & Hiring, Summarize, Plan, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/handle-a-data-subject-access-request-from-start-to-finish

## Prompt

```text
Help me handle a data subject access request (DSAR).

**Request (paste or summarize):** [TEXT]
**Date received:** [DATE]
**Requester's relationship to us:** [customer / employee / ex-employee / other]
**Applicable law:** [e.g. GDPR, UK GDPR, CCPA/CPRA, other]
**Context:** [e.g. "ex-employee in a dispute with us", "routine customer request"]
**Our systems that may hold their data:** [e.g. CRM, HR system, email, support tickets, backups, vendors]

Give me:
1. **Timeline** - the response deadline and any extension option under the law I named, marked [CONFIRM DEADLINE], with internal milestones.
2. **Identity verification** - proportionate steps, without asking for more data than needed.
3. **Clarifying scope** - whether and how I can ask the requester to narrow the request, without delaying the clock improperly.
4. **Search plan** - systems, custodians, search terms, and date ranges, as a checklist with owners.
5. **Review checklist** - third-party personal data to redact, privileged material, other possible exemptions to consider [CONFIRM EXEMPTION APPLIES], and whether a dispute or litigation affects how I handle it.
6. **Supplementary information** to include (purposes, recipients, retention, source, rights, transfers).
7. **Response letter** - clear, polite, and complete, with placeholders for the data provided.
8. **Record of handling** - a log template for accountability.

Do not state statutory deadlines or exemptions as settled; flag them for confirmation. A qualified privacy lawyer must review before responding, especially if the request is linked to a dispute.
```

## What to fill in

- TEXT
- DATE
- customer / employee / ex-employee / other
- e.g. GDPR, UK GDPR, CCPA/CPRA, other
- e.g. CRM, HR system, email, support tickets, backups, vendors
- CONFIRM DEADLINE
- CONFIRM EXEMPTION APPLIES

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.