# Dsar Response

> GDPR/CCPA data subject access request workflow: classify request, verify identity, walk systems, apply exemptions, draft acknowledgment and substantive response

- Skill: `uitbreidenos/dsar-response` (Agent Skill)
- Install (CLI): `npx skillmds@latest add uitbreidenos/dsar-response`
- Raw SKILL.md: https://api.skillmd.com/api/skills/uitbreidenos/dsar-response/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: UitbreidenOS (https://skillmd.com/u/uitbreidenos)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/uitbreidenos/dsar-response

---


# DSAR Response Skill

## When to activate
- A customer or employee submits a data access, deletion, portability, or correction request
- You need to confirm receipt within the regulatory deadline
- Identifying which systems hold the requestor's personal data
- Applying GDPR or CCPA exemptions before responding
- Drafting the substantive response letter

## When NOT to use
- Mass data breach notifications — different legal framework (Art. 33/34 GDPR)
- Regulator investigations — involve your DPO and legal counsel
- Requests that are clearly vague harassment with no legitimate purpose — still needs proper handling

## ⚠️ Important

Deadlines are strict: **GDPR: 1 month (extendable to 3 months for complex requests). CCPA: 45 days.** Missing the deadline is itself a compliance violation. Claude helps structure the process — your DPO or legal counsel should review before sending any response.

## Instructions

### Step 1 — Classify the request

```
A data subject sent this message: "[paste the request]"

Classify:
1. What type of request is this?
   - Access (Article 15 GDPR / CCPA right to know)
   - Erasure/deletion ("right to be forgotten" — Art. 17 GDPR / CCPA right to delete)
   - Portability (Art. 20 GDPR — structured, machine-readable format)
   - Rectification/correction (Art. 16 GDPR)
   - Restriction of processing (Art. 18 GDPR)
   - Objection to processing (Art. 21 GDPR)
   - Multiple rights combined

2. Which regulation applies?
   - GDPR (EU/UK resident or EU operations)
   - CCPA (California resident)
   - Both / Other

3. What is the deadline?
   - GDPR: [today's date + 30 days] = [date]
   - CCPA: [today's date + 45 days] = [date]
```

### Step 2 — Verify identity

```
Before processing, I need to verify this person's identity.

Requestor claims to be: [name, email, customer/employee]
Information they provided: [what they gave us]

What verification steps should I take?
- What's the minimum verification needed?
- What can I ask for without over-collecting data (re-identification risk)?
- When is additional verification justified vs. burdensome?

Draft the identity verification request I should send.
```

### Step 3 — Systems audit

```
I need to identify all personal data we hold for this person.

Their details: [name, email, customer ID, employee ID if known]

Walk me through all the systems we might have their data in:
[describe your tech stack and data systems]

For each system, what data might we hold?
Format: System | Data types held | How to extract | Retention period
```

### Step 4 — Apply exemptions (if applicable)

```
I'm reviewing this erasure/deletion request. Check whether any exemptions apply:

Request details: [describe]
Our legitimate grounds for holding the data: [describe]

GDPR Article 17(3) exemptions to check:
- Legal claim: do we need this data for an ongoing legal dispute or contract?
- Legal obligation: are we required by law to retain this data (e.g. tax records 7 years)?
- Public interest: does this serve scientific/historical research?
- Freedom of expression: journalism, public interest
- Public health: vital interests

If an exemption applies, note which one and draft the explanation for the response.
```

### Step 5 — Draft the acknowledgment

```
Draft the acknowledgment email/letter to send now (within 72 hours of receipt).

Include:
- Confirmation we received their request on [date]
- Reference number for tracking
- Type of request acknowledged
- Deadline for our response ([date])
- Name/contact of our DPO or privacy team
- Brief note on identity verification if needed

Regulations: [GDPR / CCPA]
Our company name: [name]
DPO/privacy contact: [name or team email]
```

### Step 6 — Draft the substantive response

```
I've completed the data inventory. Here's what I found:

Systems searched: [list]
Data found: [describe categories — name, email, purchase history, etc.]
Exemptions applied: [none / yes: describe]
Data being withheld: [none / describe reason]

Draft the full response letter for a [GDPR access / CCPA deletion] request.

Include:
- Summary of data held (or confirmation of deletion)
- Format of data provided (if access request)
- Any exemptions applied with Article reference
- Right to complain to supervisory authority
- Signature block

[VERIFY] with DPO before sending.
```

## Example

**A customer emails:** "I want to know what data you have about me and I want you to delete it."

**Claude's workflow output:**

**Classification:** Combined access + erasure request under GDPR (EU customer identified by email domain).

**Deadline:** 30 days from today = [date].

**Identity verification:** Email matches account on file — low-risk, no additional verification needed for a known customer.

**Systems to check:** CRM (HubSpot), payment processor (Stripe), email platform (Mailchimp), analytics (Mixpanel), support tickets (Intercom), backup/archive systems.

**Acknowledgment draft** (send today): Confirms receipt, reference number, 30-day response deadline, DPO contact.

**Erasure analysis:** Sales/marketing data can be deleted immediately. Payment records held 7 years under UK tax law (legal obligation exemption, Art. 17(3)(b)). Confirm exemption applies before deletion.

**Response draft:** Confirms data categories found, confirms deletion of marketing data, explains 7-year retention of payment records with legal basis, includes right to complain to ICO.

---