<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-data-subject-access-requests
description: >-
  Implement Data Subject Access Request (DSAR) workflows per GDPR Articles 15-22
  to handle access, rectification, erasure, portability, and objection requests
  within regulatory timeframes.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - dsar
  - data-subject-rights
  - gdpr
  - right-of-access
  - right-to-erasure
  - portability
  - article-15
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Implementing Data Subject Access Requests

## Overview

Data Subject Access Requests (DSARs) enable individuals to exercise their rights
under GDPR Articles 15–22: access, rectification, erasure, restriction, portability,
and objection. Organizations must respond within one month (extendable to three for
complex requests). This skill covers building DSAR intake, identity verification,
data discovery across systems, response assembly, and deadline tracking with
structured audit trails.

Mode: `[MODE: PRIVACY]` — Data subject rights fulfillment.

## Prerequisites

- Understanding of GDPR Articles 12–22 (data subject rights)
- Data inventory mapping personal data across all systems
- Identity verification process for requesters
- Python 3.10+ for DSAR management tooling
- Template responses for each right type

## Key Concepts

### GDPR Data Subject Rights

| Right | Article | Deadline | Exceptions |
|-------|---------|----------|------------|
| Access | Art. 15 | 1 month | Manifestly unfounded/excessive |
| Rectification | Art. 16 | 1 month | None |
| Erasure | Art. 17 | 1 month | Legal obligation, public interest |
| Restriction | Art. 18 | 1 month | During dispute resolution |
| Portability | Art. 20 | 1 month | Only automated processing + consent/contract |
| Objection | Art. 21 | Without undue delay | Compelling legitimate grounds |
| Automated decisions | Art. 22 | 1 month | Explicit consent, contract |

### DSAR Lifecycle

```text
RECEIVED → VERIFIED → ACKNOWLEDGED → DISCOVERY → REVIEW → RESPONSE → CLOSED

  Received:     Request intake with timestamp
  Verified:     Identity verification completed
  Acknowledged: Confirmation sent to requester
  Discovery:    Data located across all systems
  Review:       Legal review, redaction of third-party data
  Response:     Compiled response delivered to requester
  Closed:       Audit trail finalized
```

### CLI Commands

```bash
# Register a new DSAR
node scripts/agent.js --action register \
  --right "access" --subject-id "user_123" \
  --subject-email "user@example.com" \
  --output /tmp/dsar_ticket.json

# Track DSAR status and deadlines
node scripts/agent.js --action status \
  --dsar-id "DSAR-2026-001"

# Generate data discovery checklist
node scripts/agent.js --action discover \
  --subject-id "user_123" --systems "crm,email,analytics,backups" \
  --output /tmp/discovery.json

# Compile response package
node scripts/agent.js --action compile \
  --dsar-id "DSAR-2026-001" --data-sources /tmp/discovery.json \
  --output /tmp/response_package.json
```

## Workflow

### Step 1: Receive and Log Request

```bash
node scripts/agent.js --action register \
  --right "access" --subject-id "user_123" \
  --subject-email "user@example.com"
```

### Step 2: Verify Identity

Authenticate the requester to prevent unauthorized data disclosure.

### Step 3: Acknowledge Within Timeframe

Send acknowledgment confirming receipt and expected timeline.

### Step 4: Discover Data Across Systems

```bash
node scripts/agent.js --action discover \
  --subject-id "user_123" --systems "crm,email,analytics,backups"
```

### Step 5: Review, Redact, and Compile

Remove third-party personal data, apply legal review, compile response.

### Step 6: Deliver Response and Close

```bash
node scripts/agent.js --action compile \
  --dsar-id "DSAR-2026-001" --data-sources /tmp/discovery.json
```

## Verification

- [ ] DSAR registered with timestamp within 24 hours of receipt
- [ ] Identity verification completed before data disclosure
- [ ] Response deadline calculated correctly (1 month, extendable to 3)
- [ ] All data systems searched for subject's personal data
- [ ] Third-party personal data redacted from access response
- [ ] Response delivered in commonly used electronic format (Art. 15(3))
- [ ] Erasure requests propagated to all processors (Art. 17(2))
- [ ] Audit trail maintained for each DSAR

## References

- [GDPR Articles 12–22 — Data Subject Rights](https://gdpr-info.eu/chapter-3/)
- [EDPB Guidelines on Data Subject Rights](https://edpb.europa.eu/our-work-tools/our-documents/guidelines)
- [ICO Right of Access Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/)
- [ICO Right to Erasure](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/)
- [GDPR Article 12(3) — Response Timeframes](https://gdpr-info.eu/art-12-gdpr/)
