DSAR response letter template (GDPR Article 15)

An answer to an access request needs a copy of the data and eight pieces of information from Article 15(1) GDPR. Below is a letter you can copy, with a worked example.

A subject access request (DSAR or SAR) is a request from a person who wants to know what personal data you hold about them. Article 15 of the GDPR gives them that right, and Article 12 sets how and when you must answer [1]. This guide gives you a letter you can copy, explains each part, and shows a worked example.

What the answer must contain

Under Article 15(1), the person has the right to confirmation of whether you process their personal data and, if you do, access to that data plus the following information [1]:

the purposes of the processing;
the categories of personal data concerned;
the recipients, or categories of recipient, to whom the data has been or will be disclosed, in particular recipients in third countries or international organisations;
where possible, how long the data will be stored, or the criteria used to decide that period;
the existence of the right to ask for rectification or erasure, restriction of processing, or to object;
the right to lodge a complaint with a supervisory authority;
where the data was not collected from the person, any available information about its source;
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and in those cases meaningful information about the logic involved and the expected consequences.

Article 15(3) adds that you must provide a copy of the personal data. If the person made the request electronically, you give the information in a commonly used electronic format, unless they ask otherwise. For further copies you may charge a reasonable fee based on administrative costs [1]. Article 12(5) says the answer itself is free of charge [1].

Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others [1]. In practice that means you check the copy for other people's personal data, such as colleagues named in emails, before you send it.

Before you write: four checks

Date of receipt. The one-month clock runs from receipt of the request [1][3]. Write the date down. Our deadline and extension guide shows how to count it.
Identity. Only ask for extra proof if you have reasonable doubts about who is asking (Article 12(6)) [1]. See the identity verification guide.
Search. Look in every system where the person's data can be: email, CRM, invoicing, HR files, backups you actually restore from, paper files.
Third parties. Remove or redact data about other people where sharing it would harm their rights (Article 15(4)) [1].

Copyable DSAR response template

Replace everything in square brackets. Delete lines that do not apply, but do not delete a heading just because the answer is "none": say "none" instead.

Subject: Your request for access to your personal data, ref. [REF]

Dear [NAME],

On [DATE RECEIVED] we received your request for access to your
personal data under Article 15 of the GDPR. This letter is our answer.

1. Do we process your personal data?
Yes. A copy of the personal data we hold about you is attached
as [FILE NAME / FORMAT].

2. Why we use it (purposes)
- [PURPOSE 1, e.g. to deliver your orders]
- [PURPOSE 2, e.g. to send invoices and keep our accounts]

3. Which data (categories)
[e.g. name, address, email address, order history, payment status]

4. Who receives it (recipients)
[e.g. our hosting provider, our accountant, the delivery company]
Transfers outside the EEA: [none / to COUNTRY, with SAFEGUARD]

5. How long we keep it
[PERIOD, or the criteria, e.g. 7 years after the last invoice
because of tax law]

6. Where we got it
[From you / from SOURCE]

7. Automated decisions
[We do not make decisions about you based solely on automated
processing, including profiling. / DESCRIPTION, logic involved
and consequences]

8. Your rights
You can ask us to correct or erase your data, to restrict its use,
or object to its use. You can also lodge a complaint with a
supervisory authority, in [COUNTRY]: [AUTHORITY NAME, WEBSITE].

This answer is free of charge. If you would like further copies,
we may charge a reasonable fee based on our administrative costs.

If anything is unclear, reply to this email or contact
[NAME / ROLE, CONTACT DETAILS].

Kind regards,
[NAME]
[ORGANISATION]

Worked example

A small webshop receives an email on 9 March from a customer, Ana, asking "what data do you have on me?". The email comes from the same address Ana used for her orders, so there is no reasonable doubt about her identity and no reason to ask for ID.

The owner logs the request with 9 March as the date of receipt and searches four places: the shop system, the mailbox, the bookkeeping software and the newsletter tool. She exports Ana's order history and newsletter record into one PDF, and removes a note in the mailbox that names another customer. In the letter she lists two purposes (orders and accounts, and the newsletter Ana signed up for), the recipients (hosting, payment provider, courier, accountant, newsletter service), the retention period for invoices, and the name and website of her national data protection authority. She sends it on 20 March, well within the month.

Common mistakes

Sending only the data, not the information. The eight points from Article 15(1) are part of the answer, not an optional extra [1].
Charging for the first answer. Under Article 12(5) it is free. You may only charge a fee, or refuse, if a request is manifestly unfounded or excessive, and you must be able to show that [1].
Asking for a passport by default. The EDPB says the identity check must be proportionate, and a copy of an ID document should not be requested unless it is necessary [2][4].
Waiting. Article 12(3) asks for an answer without undue delay. One month is the outer limit, not a target [1].
Using unclear language. Article 12(1) asks for a concise, transparent, intelligible and easily accessible form, using clear and plain language [1].

Plain-language tips for the letter

Write the way you would explain it on the phone. Avoid internal system names: "our order system" says more to Ana than "Magento DB prod". Put the most important answer, yes we process your data and here it is, at the top. If the copy is large, add a short guide to the files, for example "orders.csv: one line per order since 2021". Keep a copy of what you sent, with the date, so you can show later that you answered on time.

Not sure which way of handling requests fits your organisation? Read our comparison of a spreadsheet, a tool and a consultant.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.