GDPR Data Subject Rights: How to Handle Requests Within One Month

GDPR data subject rights give people control over their personal data. Anyone whose data you process can ask to see it, correct it, delete it, move it, or object to how you use it. You must respond within one month, for free in most cases. For SaaS companies, requests come both from your own users and, as a processor, from your customers' end users. This guide explains each right, the deadlines and exemptions, and a simple process to handle requests.

Related guides: Data processing agreements · Data protection impact assessment · GDPR breach notification requirements · GDPR compliance for SaaS

Key takeaways

• GDPR Articles 12 to 22 give individuals eight rights, including access, rectification, erasure, restriction, portability and objection.
• Respond without undue delay and within one month. You can extend by two further months for complex or numerous requests, if you tell the person within the first month.
• Requests are usually free. You can refuse or charge a reasonable fee only if a request is manifestly unfounded or excessive.
• As a processor, you help your customer respond. As a controller, you respond directly.

---

The eight GDPR data subject rights

Right	Article	What the person can ask for	Typical SaaS action
Right to be informed	13, 14	Clear information about how their data is used	Keep the privacy notice accurate and easy to find
Right of access	15	A copy of their data and information about its processing	Export account data, logs and support history
Right to rectification	16	Correction of inaccurate data	Let users edit profiles; fix records on request
Right to erasure	17	Deletion of their data in certain cases	Delete the account and data, apart from records you must keep
Right to restriction	18	Limit processing while a dispute is resolved	Flag the record so it is stored but not used
Right to data portability	20	Data they provided, in a machine-readable format	Export in JSON or CSV
Right to object	21	Stop processing based on legitimate interests or for direct marketing	Unsubscribe from marketing, stop profiling
Rights on automated decisions	22	Not be subject to solely automated decisions with legal or similar effects	Offer human review and an explanation

Deadlines and fees

• One month from receipt to respond. If the deadline falls on a weekend or holiday, many regulators accept the next working day.
• Extension of up to two months for complex or numerous requests, but you must tell the person within the first month and explain why.
• Free of charge, except where a request is manifestly unfounded or excessive, for example repetitive requests. In that case you may charge a reasonable fee or refuse, and must explain your reasons.
• Requests do not have to use special wording or a particular channel. An email to support saying "send me everything you hold about me" is a valid access request.

How to handle a data subject request in six steps

1. Recognize and log it. Train support and sales to spot requests in any channel. Log the date received, the right exercised and the requester.
2. Verify identity. Use reasonable, proportionate checks, such as confirming the request from the account's email address. Do not ask for more information than you need.
3. Clarify scope if needed. For broad access requests, you may ask the person to specify what they want, but the clock keeps running for the information you can already provide.
4. Find the data. Search production databases, backups (according to your policy), support tools, CRM, email, analytics and vendors that process data for you.
5. Act and respond. Provide the data, make the change or delete it, and explain what you did. For access requests, include the purposes, categories of data, recipients, retention period, source and the person's other rights.
6. Record the outcome. Keep a record of the request, actions and response date as evidence of compliance.

When you can refuse or limit a request

• Erasure does not apply where you must keep data to comply with a legal obligation, such as tax records, or to establish or defend legal claims.
• Access must not adversely affect the rights of others. Redact other people's personal data.
• Portability applies only to data the person provided, processed by automated means on the basis of consent or contract.
• Objection to processing based on legitimate interests can be refused if you show compelling legitimate grounds, but objection to direct marketing must always be honored.
• National laws add further exemptions in some countries.

Always explain any refusal and tell the person they can complain to a supervisory authority.

Data subject requests when you are a processor

If a customer's end user contacts you directly, do not answer the request yourself unless your contract says so. Forward it to the customer, the controller, promptly, and help them respond as your DPA requires. Build product features, such as admin exports and deletion tools, so customers can handle most requests themselves.

Making it easier with product design

• Self-service profile editing and account deletion
• A one-click data export in a common format
• Clear marketing preferences and unsubscribe links
• Admin tools for business customers to export or delete their users' data
• Deletion that flows through to backups and vendors on a documented schedule

Common mistakes

• Treating requests sent to the wrong inbox as invalid
• Asking for excessive identity documents, such as a passport copy for a simple request
• Forgetting data held in support, analytics or marketing tools
• Missing the one-month deadline because nobody owned the request
• Deleting data you are legally required to keep

Sample response to an access request

A good response to an access request usually includes:

1. A copy of the personal data, in a common electronic format if the request was made electronically.
2. The purposes of the processing.
3. The categories of personal data concerned.
4. The recipients or categories of recipients, especially any outside the EU.
5. How long the data will be kept, or the criteria used to decide.
6. The person's rights to rectification, erasure, restriction and objection.
7. Their right to complain to a supervisory authority.
8. The source of the data if you did not collect it from them.
9. Whether automated decision-making, including profiling, is used, with meaningful information about the logic involved.

Many of these points can come straight from your privacy notice and records of processing, so keep both current.

Tracking requests

Keep a simple log with the date received, requester, right exercised, identity check, owner, due date, extension (if any), actions taken and date closed. Review open requests weekly. This log is the evidence a regulator, customer or auditor will ask for, and it shows how many requests you receive each year, which helps decide when to invest in automation.

Field	Example
Received	3 March, via support email
Right	Access (Article 15)
Identity check	Confirmed from account email
Owner	Privacy lead
Due date	3 April
Outcome	Export sent 18 March, closed

How SecureSlate helps

SecureSlate maps data subject rights to your GDPR controls, tracks the procedures and evidence auditors and customers ask for, and keeps your vendor inventory current so you know which processors hold personal data.

FAQ

What is a DSAR?

A data subject access request is a request under Article 15 for a copy of the personal data you hold about someone and information about how you use it.

How long do we have to respond to a GDPR request?

One month from receipt, extendable by two further months for complex or numerous requests if you inform the person within the first month.

Can we charge for a data subject access request?

Generally no. You can charge a reasonable fee only for manifestly unfounded or excessive requests, or for additional copies.

Do we have to delete data from backups?

You must have a clear approach. Many companies put deleted data beyond use and let it expire from backups on their normal cycle, documenting this in their retention policy.

Does the right to erasure always apply?

No. It applies in specific cases, such as when data is no longer needed or consent is withdrawn, and does not override legal obligations to keep certain records.

Who should handle data subject requests in a small company?

A named owner, often the privacy or compliance lead, with support from engineering to find and act on the data.

---

Can someone make a request on behalf of another person?

Yes, for example a lawyer or relative, if they show they are authorized. Check the authority before you disclose anything.

Do data subject rights apply to employee data?

Yes. Employees and job applicants have the same rights, and access requests from employees are common, especially during disputes.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory, or professional advice. Requirements vary by framework, industry, and jurisdiction. Consult qualified advisors for your specific obligations.