Legitimate DSAR Processing

Process a data subject access request end to end.

What You'll Learn in Legitimate DSAR Processing

Legitimate DSAR Processing Training Steps

  1. Introduction

    Alice works in the Privacy Operations team at CloudServe Technologies, a B2B SaaS provider that helps businesses manage their cloud infrastructure. Her role involves handling data subject access requests (DSARs) under GDPR. Today, she will process a legitimate DSAR from a verified customer – a request that requires careful attention to deadlines, data discovery, and third-party redaction.

  2. DSAR Receipt

    Alice receives a new email in her work inbox. The subject line indicates it is a formal data subject access request. The email is from jennifer.martinez@acme-corp.com - a verified customer whose company has an active contract with CloudServe Technologies.

  3. Identity Verification

    Before processing the request, Alice must verify that the person making the request is actually Jennifer Martinez. However, GDPR requires that verification be proportionate - Alice should not create excessive barriers. Since the request came from an email address already associated with the customer account, and includes the correct customer ID, Alice has reasonable assurance of identity.

  4. Logging the Request

    Alice accesses the DSAR queue in the privacy portal. She sees Jennifer's request has been automatically logged with today's date, which starts the 30-day response clock. The system shows all the information needed to verify the requestor's identity against existing customer records.

  5. Sending Acknowledgment

    With identity verified, Alice now needs to send an acknowledgment email to Jennifer. This confirms receipt of the request and sets expectations for the response timeline. Good practice is to acknowledge DSARs promptly, even though GDPR does not strictly require it.

  6. Data Discovery

    Now Alice must search all company systems for Jennifer's personal data. GDPR requires providing all personal data held about the individual - not just obvious places like the CRM. Alice needs to check: CRM records, support tickets, billing systems, email communications, system logs, and any backups that might contain personal data.

  7. Running Data Search

    Alice enters Jennifer's email address to search across all connected systems. The privacy portal automatically queries the CRM, support ticketing system, billing platform, and access logs. The search returns data from multiple sources - some containing only Jennifer's data, and some containing data about other individuals as well.

  8. Supervisor Call - Redaction Requirements

    While reviewing the search results, Alice notices that several support tickets contain data about other ACME Corp employees who were CC'd on communications. She needs guidance on how to handle third-party data. She calls her supervisor, David Chen, to discuss the redaction requirements.

  9. Reviewing and Redacting Data

    Following David's guidance, Alice reviews the compiled data export. She identifies several pieces of information that need redaction: - Email addresses of other ACME Corp employees in support ticket threads - Names of CloudServe staff members who handled support cases - Internal ticket IDs that could expose other customers' data Alice must provide Jennifer with all her own data while protecting others' privacy.

  10. Applying Redactions

    Alice carefully reviews each data source and applies redactions to protect third-party information. The privacy portal helps by highlighting potential third-party data, but Alice must make the final decision on each redaction. She ensures that all of Jennifer's personal data remains visible while other individuals' information is properly obscured.