Subject access requests (DSARs) and erasure requests: answer within one month, without panic

Who this is for

Oficina Rocha, Marta, Inês, Rui and the people who write to them are fictional. The rules, deadlines and authority findings are real and sourced.

Scene 1 · Tuesday 27 October, 9:10

“Send me everything you have on me”

Marta is the office manager at Oficina Rocha, a 45-person furniture maker near Braga, in northern Portugal, with an online shop. She also “does GDPR”, on Friday afternoons. Today, clearing out the general info@ inbox, she finds this:

From: paulo.m…@gmail.com · To: info@ · 6 October, 22:47

Good evening. I left the company in June. I’d like to receive all the personal data Oficina Rocha holds about me. Thanks, Paulo Mendes

The email is three weeks old. Marta’s first reaction is a common one: “he sent it to the wrong address, does this even count?” It does. The clock started on 6 October and stops on 6 November. Ten days left.

She calls Inês, the external DPO who supports the company. Inês stays calm: “Ten days is enough if we start today. Let’s do this in the right order.” This guide is that order.

This happens a lot. When Europe’s data protection authorities looked at 1,185 organisations in 2024, one of the most frequent problems was failing to recognise requests that don’t mention the GDPR or that arrive through channels not set up for them. And 74% of those organisations had received between zero and ten access requests the year before. With so few requests, nobody remembers the procedure when it’s needed.

Source: EDPB, 2024 coordinated enforcement report on the right of access (adopted 16 Jan 2025).

Free template: the Access and Erasure Request Log puts this guide into a ready-to-use spreadsheet.

STEP 1

Recognise the request

The GDPR sets no form for a request. It can arrive by email, letter, phone, web form, social media or in person to a colleague. The person doesn’t need to write “Article 15” or explain why they want the data. The European Data Protection Board (EDPB) is clear: you should not assess “why”, and you can’t refuse just because the request doesn’t mention the law.

There is a sensible limit. If you’ve published a dedicated channel and someone writes to an address that has nothing to do with it (the EDPB’s example is the cleaning staff’s email), the request may not count. But a general address like info@ or customer support does, and the EDPB expects you to make “all reasonable efforts” to pass it on. Time the request spends lost in an inbox doesn’t extend the deadline.

EDPB Guidelines 01/2022 on the right of access, v2.1, paras 13, 50, 52–57 and examples 8 and 9.

STEP 2

Count the deadline to the day

The GDPR says “one month”, not 30 days. The count follows the EU rules on time limits: the day the request arrives doesn’t count, and the period ends on the same date the following month. If that date doesn’t exist, it ends on the last day of the month. If it falls on a Saturday, Sunday or public holiday, it moves to the next working day.

Some authorities, including Portugal’s CNPD, tell the public they can expect an answer within “30 days”. Working to 30 days is the safest way never to miss the month.

Extension. You can add up to two months “where necessary, taking into account the complexity and number of the requests”. Two conditions: tell the person within the first month, and give the reason (template 4). An extension sent on day 35 is too late.

Also handling UK requests?

UK practice differs in places. The UK regulator, the ICO, says the clock pauses while you wait for clarification you have asked for, doesn’t start until you have the identity information you requested, and that you only need to carry out a reasonable and proportionate search. That is UK guidance under the UK GDPR. For requests under the EU GDPR, follow the EDPB rules in this guide.

ICO, What should we consider when responding to a request?

Art. 12(3) GDPR; Regulation (EEC, Euratom) No 1182/71, Art. 3; CNPD, Right to erasure (PT).

STEP 3

Check identity, proportionately

Ask for more information only when you have reasonable doubts about who is making the request, and only for what you actually need. The reflex of asking everyone for a copy of their ID card is a mistake: the EDPB says it is generally not an appropriate way to authenticate someone and creates a security risk. In their 2024 report, the authorities wrote that asking for an ID document indiscriminately “may constitute excessive processing”.

Use what you already have. A customer with an account on the online shop can confirm through the account. A former employee can confirm something only they and the company know, or receive the reply at the contact details already on their file. In Paulo’s case, his personal email was already on his HR record, so Inês didn’t ask for anything else.

If you really do need to check, ask in the first few days (template 2) so you don’t burn the month waiting.

Art. 12(6) and Recital 64 GDPR; EDPB Guidelines 01/2022, paras 73–77 and examples 13 and 14; EDPB CEF 2024 report.

STEP 4

Access: what you have to send

An access reply has two parts. Think of it as a folder with a copy inside and a cover sheet on top.

What the Court of Justice has already decided

Art. 15 GDPR; CJEU C-154/21, C-487/21, C-307/22, C-579/21; EDPB Guidelines 01/2022.

STEP 5

Where to look

The authorities’ number one finding in 2024 was searches that were too narrow: looking only in the main database and forgetting emails, metadata, non-text files or backups. They point out that you can’t limit your reply to the data you consider relevant.

At Oficina Rocha, Rui from IT searched Paulo’s name and email addresses across the mailboxes, the file server and the payroll software, and confirmed that June’s CCTV footage had already been deleted in the normal cycle. It took a morning. Marta pulled the HR file. Inês reviewed everything and redacted customer and colleague details.

EDPB CEF 2024 report, challenge 1 and recommendations; Art. 30 GDPR.

Scene 2 · Two weeks later

“Delete my account and everything you have on me”

Paulo got his reply on 4 November, two days before the deadline. Marta can breathe again. Then a message comes in through the online shop’s form from Sofia, a customer who bought a table in 2024 and gets the newsletter.

Deleting everything sounds simple. But the table’s invoice has Sofia’s name and address on it, and tax law says it must be kept. The newsletter goes out through an external platform. And there are backups every night. Marta writes to Inês: “Do I delete it or not?” The answer: “Both. Let’s work out which is which.”

STEP 6

Erasure: when you must delete and when you can keep

The right to erasure, also called the “right to be forgotten”, is not absolute. First check whether one of the grounds applies. Then check whether any exception applies, case by case and in writing.

Three places where organisations trip up

Closing an account is not the same as erasing the data. The authorities have asked for more awareness of this difference, because many organisations treat them as one and the same.

Art. 17 and 19 GDPR; EDPB 2025 coordinated enforcement report on the right to erasure (adopted 10 Feb 2026); ICO, Right to erasure (UK guidance, useful examples).

STEP 7

Refuse or limit, and stay on solid ground

You can refuse, or charge a reasonable fee, only if a request is manifestly unfounded or excessive, for example because it’s repetitive. The EDPB says these terms must be read narrowly, and it’s up to you to show that the request is one of them. A request repeated because your first answer was incomplete is just a reminder, not a new request.

Don’t use refusal to avoid work either. If someone asks for everything and you have years of data across many systems, you can ask whether they’d like to start with a particular area (template 3). But the EDPB warns that this request for specification must not be used to limit the reply. If they say “everything”, send everything.

Whenever you don’t act on a request, in whole or in part, you must reply within one month with your reasons and tell the person they can complain to a supervisory authority and go to court (template 7).

Art. 12(4)–(5) and 15(4) GDPR; EDPB Guidelines 01/2022, para 29 and section 6.

What the authorities actually found

Seven things not to do

These problems kept coming up.

1. 1
   No written procedure.Seventeen authorities found organisations with no documented, up-to-date procedure for erasure. Some review theirs every five years, or never.
2. 2
   Not recognising the request or acknowledging it.Requests that don't mention the GDPR, or arrive through channels not set up for them, go unanswered.
3. 3
   Asking everyone for ID.Mandatory web forms, written-only requests and ID by default are all barriers to exercising the right.
4. 4
   Searching only the main database.Emails, metadata, non-text files and backups get left out.
5. 5
   Replying with the privacy notice.Generic information, recipients only as categories and vague retention periods instead of answers tailored to the person.
6. 6
   Keeping the request log forever.Retention periods for the requests themselves ranging from six months to 45 years, or none at all. Set a period and store these records separately.
7. 7
   Applying exceptions automatically.More than a dozen authorities saw Art. 17(3) exceptions applied without a case-by-case assessment, and refusals with no documented reason.

EDPB CEF 2024 report (access); EDPB CEF 2025 report (erasure).

Print this

The month, day by day

Reply templates

Seven replies ready to adapt

Replace everything in [square brackets]. Write the way one person writes to another: these replies are read by the person who asked and, sometimes, by a regulator.

Dear [Name],
We received your request on [date received], asking for [summary: access to your personal data / erasure of your data].
We will reply by [deadline]. If the request turns out to be particularly complex and we need more time, we will let you know before that date and explain why.
Your request reference is [No.]. If you have any questions, just reply to this email.
Kind regards,
[Name]
[Role] · [Organisation]

Dear [Name],

To protect your data, we need to be sure the request comes from you. In this case, [specific reason: the email you used isn’t the one linked to your account].
You can confirm in either of these ways:
– [proportionate option 1: reply from the email address linked to your account]
– [proportionate option 2: give us the number of a recent order]
You don’t need to send us a copy of an ID document. As soon as we have your confirmation, we’ll carry on with your request.
Kind regards,
[Name] · [Organisation]

Dear [Name],

We’ve started gathering your data. We hold information about you in [list: your HR file, work emails from [year] to [year], building access records].
So that we can send you what matters most to you first, is there a particular area or period you’d like to receive? If you’d prefer everything, just tell us and we’ll send it all within the deadline, by [deadline].
Kind regards,
[Name] · [Organisation]

Dear [Name],
We are working on your request of [date received]. We need more time because [specific reason: your data is held in seven different systems and includes around [N] emails over several years, which we need to review to protect other people’s data].
For that reason, and as Article 12(3) of the GDPR allows, we are extending the deadline. We will reply by [new date, at most three months after receipt].
[Optional: In the meantime, please find attached [the part that is already ready].]
If you disagree with this extension, you can complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt].
Kind regards,
[Name] · [Organisation]

Dear [Name],
In reply to your request of [date received], please find attached a copy of the personal data we process about you [format: PDF file / password-protected zip folder, with the password sent separately].

Why we use your data: [specific purposes, e.g. managing your employment contract, running payroll, meeting tax and social security obligations].
What data we process: [categories: identification, contact details, bank details, attendance records, performance reviews].
Who we have shared it with: [actual recipients: social security authority, tax authority, [name of accounting firm], [name of insurer]].
How long we keep it: [period or criteria for each category].
Your rights: you can ask us to rectify, erase or restrict the processing of your data, or object to it.
You can complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt].
Where the data came from: [you provided it / we obtained it from [source]].
Automated decisions: [we do not make solely automated decisions about you / description and logic].
[If applicable: Transfers outside the EEA: [country, safeguard used].]

To protect other people, we have redacted [details of colleagues and customers] in [documents].
If anything is missing, or you have questions, just reply to this email.
Kind regards,
[Name] · [Organisation]

Dear [Name],

We have dealt with your request of [date received].
What we deleted: [your online shop account, the order history shown in your account, your preferences, and your contact from our newsletter list].
What we have to keep: [the invoices for your purchases], because [specific legal obligation: tax law requires us to keep them for the legal retention period]. We will keep them only for that purpose and delete them on [date or criterion].
Who else we told: we asked [name of email marketing platform / other recipients] to delete your data.
Backups: your data still exists in backups made before today. Those backups are deleted automatically by [date], and we will not use your data again if a backup ever has to be restored.
If you disagree with this reply, you can complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt] or go to court.
Kind regards,
[Name] · [Organisation]

Dear [Name],

We have considered your request of [date received] and will not be acting on it [in full / in part: say which part].
The reason: [specific explanation, e.g. we answered an identical access request on [date] with a full copy of your data, and we have not processed any new data about you since. / The data you asked us to erase is needed to defend a pending court case, ref. [No.] (Article 17(3)(e) GDPR), and will be erased when the case ends.]
If you disagree, you have the right to complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt] and to go to court.
Kind regards,
[Name] · [Organisation]

What may change · status on 21 October 2026

An EU proposal targets “abusive” access requests

In November 2025, the European Commission put forward the Digital Omnibus package, COM(2025) 837. For the right of access, it proposes three changes to Art. 12(5): allowing controllers to refuse or charge a fee when the right of access is used for purposes other than protecting one’s data; lowering the burden of proof, so that it’s enough for the controller to have “reasonable grounds to believe” a request is excessive; and, in a recital, treating “overly broad and undifferentiated” requests as excessive.

The EDPB and the European Data Protection Supervisor (EDPS) agreed with the aim of giving more clarity, but asked for those three wordings to be removed (Joint Opinion 2/2026, 10 February 2026). They point out that, under the Court of Justice’s ruling in C-307/22, people don’t have to justify their requests.

In October 2026, EU ambassadors had the Council’s mandate for negotiations with the European Parliament on their agenda. The proposal is not law. The rules in this guide apply today. We’ll update this box once a final text is published in the Official Journal. We look at the proposal in more detail, data breaches included, in our article on the Digital Omnibus.

Separately, another proposal (Omnibus IV) is set to extend the exemption from keeping a record of processing to organisations with fewer than 1,000 people, except for high-risk activities (provisional agreement of 26 June 2026). Even if you’re exempt, you’ll still need to know where your data is to answer these requests.

COM(2025) 837; EDPB-EDPS Joint Opinion 2/2026; Coreper agenda, October 2026; Procedure 2025/0130(COD).

Before you send

Checklist

Common questions

Frequently asked questions

How long do I have to answer an access request?

One month from receipt, to the same day of the following month (Art. 12(3)). If the request is complex or you have many, you can extend by up to two more months, as long as you tell the person within the first month and explain why.

Can I ask for a copy of an ID card to confirm identity?

As a rule, no. You can only ask for more information when you have reasonable doubts about who is making the request (Art. 12(6)), and the EDPB considers a copy of an identity document generally not an appropriate means. Use what you already have, such as the customer account or the contact details on file.

Can I charge for the copy of the data?

The first copy is free, and the person doesn’t have to explain why they want it (C-307/22). You can only charge a reasonable fee for further copies (Art. 15(3)) or when the request is manifestly unfounded or excessive, which you must be able to show (Art. 12(5)).

A customer asked for erasure. Do I have to delete the invoices too?

No, as long as tax law requires you to keep them. The right to erasure doesn’t apply to the extent that processing is necessary to comply with a legal obligation (Art. 17(3)(b)). Keep only the invoice, only for that purpose and only for the legal period, delete the rest and explain this in your reply.

Who answers the request: the company or the DPO?

The company, as controller. The DPO advises, tracks the deadline and is a contact point for individuals (Art. 38(4)), but the decision and the reply belong to the controller. The guide for external DPOs with several clients explains where the DPO’s role ends.

What if my reply sends someone else’s data by mistake?

That is a personal data breach. Try to recall the message or ask for it to be deleted, record the incident and assess the risk: if there is a risk, you have 72 hours to notify the supervisory authority. The guide to the first 72 hours shows how to decide.

Sources

Legislation and case law

• Regulation (EU) 2016/679 (GDPR), Art. 8, 12, 15, 17, 19, 21, 30, Recitals 63 and 64
• Regulation (EEC, Euratom) No 1182/71, rules on time limits
• CJEU, C-154/21, Österreichische Post (12 Jan 2023), recipients
• CJEU, C-487/21, F.F. v CRIF (4 May 2023), meaning of “copy”
• CJEU, C-579/21, J.M. v Pankki S (22 Jun 2023), consultation by employees
• CJEU, C-307/22, FT v DW (26 Oct 2023), first copy free of charge

European Data Protection Board (EDPB)

• Guidelines 01/2022 on the right of access, v2.1 (April 2023)
• 2024 coordinated enforcement report, right of access
• 2025 coordinated enforcement report, right to erasure
• EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus

National authorities and the legislative process

• CNPD (Portugal), Right of access (in Portuguese)
• CNPD (Portugal), Right to erasure (in Portuguese)
• ICO (UK), What should we consider when responding to a request?
• ICO (UK), Right to erasure
• European Commission, COM(2025) 837, Digital Omnibus
• Council of the EU, Coreper agenda, 9 Oct 2026
• European Parliament, procedure 2025/0130(COD), Omnibus IV

Last reviewed: 21 October 2026. We review this guide whenever the rules or the authorities’ guidance change.

This guide is general information, not legal advice. For specific cases, talk to your DPO or a lawyer.

Oficina Rocha and everyone in the scenes are fictional.