Data Subject Access Request Workflow

How do I set up this workflow for our privacy team?

Publish the template in your workspace and it runs the live process immediately, no installation needed. Add your privacy team and privacy officer as workspace members so they receive the verification, collection and approval tasks. The public request form is ready to share as soon as the workflow is published.

How does identity verification work, and what happens if more information is needed?

The privacy team completes a task to verify identity, recording the result and any notes on the record. If the result is 'More information needed', the status changes to Awaiting Response and the requester is emailed a form to supply extra details, without needing an account. Once they reply, the workflow saves their answers and restarts the identity verification task automatically.

What happens if the privacy officer rejects the collected response?

When the privacy officer's approval outcome is rejected, the workflow returns to the records collection task so the privacy team can rework the search and redaction. This loop repeats until the response is approved, and each pass is captured in the record's timeline. The status stays at Under Review until approval is given.

Can I change the due dates or task deadlines?

Yes, describe the change in plain English or edit the steps directly in the workflow editor, for example adjusting the 3-day identity verification deadline or the 10-day collection window. Earlier versions of the workflow are kept, so you can review what changed. Changes apply to new and in-progress requests going forward.

How do requesters submit their request and interact with the workflow?

Requesters submit the public request form with their details, proof of identity and what information they're asking for. After that, they only interact through emails sent to them, including the acknowledgement, any additional identity details form, and the completion notification. They never need to create an account.

Where is the collected information and delivery method stored?

Because the workflow waits on the identity verification, records collection and secure delivery tasks, what's entered on each is saved directly to the record. This includes the verification result, the summary of records searched and redacted, the collected response document, and the delivery method and date sent. All of this is visible in the record's timeline alongside its status.

Can we track how many DSARs are open, overdue or completed?

Yes, each request is a record with a status such as Received, Collecting, Under Review or Completed, and table views and dashboards group records by status. This makes it easy to see which requests are approaching their statutory due date. Workspace activity is also logged for each record.

Does this workflow guarantee we meet data protection regulations?

The workflow records statuses, due dates, verification results and the actions your team enters at each step, giving you a clear timeline of how each request was handled. Each business should confirm its own regulatory obligations and whether this record-keeping meets them. It's designed to support consistent handling, not to certify compliance.

Who is responsible for each step in the process?

The privacy team handles identity verification, records search and redaction, and secure delivery, each assigned as a task with its own due date. The privacy officer reviews and approves or rejects the collected response before it goes out. Admins and members in your workspace can be assigned to these tasks based on their role.