OptOutDeck
Menu

DSAR response template

Write the letters a data subject access request needs, from the acknowledgement to the full response: the identity request, the extension notice and a refusal with its reasons too. Pick the GDPR, the CCPA or a US state law, and each letter carries the elements that rule names, with the article or section beside it and the date it has to go by. Copy it into an email or print it. It runs in your browser; nothing you type is sent anywhere.

Build your letter

Pre-filled with a realistic case: a 30-person online bike shop answering a customer’s access request that arrived on Mon 31 Aug 2026. Change anything and the letter below rewrites itself. Reset clears it for your own.

Which letter
Which law
The Art. 15 answers: 7 fieldsopen

Send by, Full response

Wed 30 Sep 2026

GDPR Art. 12(3): one monthYour letter is dated 2 days before this date.

Live preview: this is what Print keeps and Copy takes.

Brightwell Cycles Ltd

Mon 28 Sep 2026

Dear Maria Keane,

Your personal data: our reply to your access request

We have now dealt with your request of Mon 31 Aug 2026, reference DSAR-2026-014. We confirm that we process personal data about you. A copy of it is attached to this email as a PDF and a spreadsheet, protected by a password we will send you by text message.GDPR Art. 15(1), 15(3)

Below is the information about how we use your data that the GDPR entitles you to.

Why we use it
To take and deliver your orders, handle returns and warranty claims, answer your messages, keep our accounts as tax law requires, and send you our newsletter, which you agreed to receive.Art. 15(1)(a)
What kinds of data
Your name, contact details and delivery addresses; your order, payment and return history (not your full card number); your warranty claims; your messages to our support team; and how you use our newsletter.Art. 15(1)(b)
Who receives it
Our courier companies, our payment provider, our email newsletter provider, our support-desk software provider, and our accountants.Art. 15(1)(c)
How long we keep it
Order and payment records for six years after the end of the financial year, as tax law requires; support messages for two years after the last message; newsletter data until you unsubscribe.Art. 15(1)(d)
Where it came from
Almost all of it comes from you. Delivery updates come from our couriers.Art. 15(1)(g)
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling.Art. 15(1)(h)
Transfers outside the EU
Our newsletter provider and our support-desk provider store data in the United States. Both transfers rely on the European Commission's standard contractual clauses; you can ask us for a copy.Art. 15(2)
Your other rights
You can ask us to correct or erase your data, to restrict how we use it, or object to our using it.Art. 15(1)(e)
Complaints
You can complain to a supervisory authority: the Data Protection Commission in Ireland (www.dataprotection.ie).Art. 15(1)(f)

We have removed from the copy personal data about other people, where sending it would adversely affect their rights and freedoms.Art. 15(4)

This copy is free. If you ask for further copies, we may charge a reasonable fee based on our administrative costs.Art. 15(3)

If you have any questions, reply to this letter or write to privacy@brightwellcycles.example.

Yours sincerely,

Brightwell Cycles Ltd, privacy team

privacy@brightwellcycles.example

What this letter must carry

Every element below is in the draft. “Guidance” rows come from regulator guidance or good practice, not the text of the law.

  • Confirms whether you process their dataArt. 15(1)in the letter
  • A copy of the data, electronic if they asked electronicallyArt. 15(3); Art. 12(3)in the letter
  • Why we use itArt. 15(1)(a)in the letter
  • What kinds of dataArt. 15(1)(b)in the letter
  • Who receives itArt. 15(1)(c)in the letter
  • How long we keep itArt. 15(1)(d)in the letter
  • Where it came fromArt. 15(1)(g)in the letter
  • Automated decisionsArt. 15(1)(h)in the letter
  • Transfers outside the EUArt. 15(2)in the letter
  • Their rights to rectify, erase, restrict and objectArt. 15(1)(e)in the letter
  • The right to complain to a supervisory authorityArt. 15(1)(f)in the letter
Photocopy-style paste-up of a barred page sliding into an envelope beside a rubber stamp

What each rule asks of the letter

GDPR: answer
one monthArt. 12(3)
GDPR: extension
two further months, with the reasons, notified within the first month
GDPR: refusal
reasons, complaint and court route, within one monthArt. 12(4)
GDPR: what the answer holds
confirmation, a copy, items (a) to (h)Art. 15(1)–(3)
California: confirm receipt
10 business days§ 7021(a)
California: respond
45 calendar days; 90 calendar days in all§ 7021(b)
California: categories answer
six items§ 7024(k)
Virginia: refusal
justification and how to appeal, within 45 days§ 59.1-577(B)(2)
California: keep request records
at least 24 months§ 7101(a)

GDPR, EDPB Guidelines 01/2022, CCPA statute and regulations, Va. Code § 59.1-577; read 22 Oct 2026. Information, not legal advice.

What it works out

A DSAR response template is the set of letters you send someone who has asked what personal data you hold about them: from the note that says you have the request to the reply that answers it. If the request itself is new to you, read what a DSAR is first. This builder writes each letter under the GDPR, the CCPA or a US state law, puts in every element the rule asks for with the rule named beside it, and works out the date the letter has to go by.

  1. Pick the letter you need now, and the law the requester sits under.
  2. Enter the day the request arrived and the date on your letter. The send-by date comes from the DSAR deadline calculator’s own code, and the tool tells you if your letter would be late.
  3. Fill the fields for that letter. For the full response, most of the answers come from your record of processing, your data map and your retention schedule.
  4. Read the list of what the letter must carry. Anything marked “fill in” or “check this” is still open in the draft.
  5. Copy the letter into your email, or print it. Keep a copy: it is part of your record of the request.

Worked example: one request, five letters

The bike shop in the builder received an access request on Mon 31 Aug 2026. The table runs it through every letter under the GDPR, the CCPA and Virginia’s law, with the date each letter has to go out by. The dates are the builder’s own, so they match what the tool shows.

Send-by date of each DSAR letter for a request received Mon 31 Aug 2026, under three laws
LetterGDPRCaliforniaVirginia
AcknowledgementStraight awayMon 14 Sep 2026Straight away
Identity requestStraight awayStraight awayStraight away
Extension noticeWed 30 Sep 2026Thu 15 Oct 2026Thu 15 Oct 2026
Full response (request to know in California)Wed 30 Sep 2026Thu 15 Oct 2026Thu 15 Oct 2026
Refusal in fullWed 30 Sep 2026Thu 15 Oct 2026Thu 15 Oct 2026
GDPR Arts 12(3)–(4); CCPA regulations §§ 7021, 7024; Va. Code § 59.1-577. Assumes no extension; the refusal row is a refusal in full. read 22 Oct 2026.

Two dates catch teams out. In California the acknowledgement is due within 10 business days, while the GDPR sets no date for one at all. And under the GDPR a refusal in full has one month, extension or not: Art. 12(4) gives the reasons “at the latest within one month of receipt”. In the builder, a partial refusal goes out with the answer and takes the answer’s date, extended or not.

Where reply letters go wrong

A reply can arrive on time and still fall short. These are the gaps the builder is set up to close, and the rule behind each.

Common mistakes in DSAR reply letters, the rule each one breaks, and how the template handles it
MistakeWhy it failsIn the template
Sending the data export and nothing elseArt. 15 also asks for the purposes, recipients, retention and the other items; an export answers one duty of threeThe full response lists all of them beside the copy
Pointing a Californian to the privacy policyAllowed only when your answer would be the same for every consumer and the policy says all of it (§ 7024(j))The request-to-know response asks for the six § 7024(k) items for this person
Refusing because the copy names other peopleOthers' rights justify blacking out their data, not refusing all of it (Art. 15(4), Recital 63)Partial refusal, with the redaction named and the rest sent
Asking for a passport copy by defaultThe EDPB calls an ID copy generally inappropriate; use what you already hold (paras 74–75)The identity letter asks for a login, account email or order detail
Telling the person about an extension too lateIt only counts inside the first period, with the reasons (Art. 12(3); § 7021(b))The extension notice shows its own send-by date
A refusal with no way outThe GDPR wants the complaint and court route (Art. 12(4)); Virginia wants appeal instructions (§ 59.1-577(B)(2))The refusal letter always carries the line its law asks for
GDPR, EDPB Guidelines 01/2022 (v2.1), CCPA regulations, Va. Code § 59.1-577; read 22 Oct 2026.

Once requests arrive every month, writing each letter by hand stops paying. Our DSAR software comparison covers tools that keep the clock and the letters in one place.

Jurisdiction notes

EUCAVACOCTTXORMTIADETNMNMDINNENH

EU. The letters follow the GDPR and the European Data Protection Board’s guidelines on the right of access. They do not cover the UK GDPR. A Member State law can restrict the right in some cases under Art. 23, so check your own country’s act before relying on that ground. For how the EU and California rules differ beyond the letters, see GDPR vs CCPA.

California. The letters cover the request to know. Requests to delete and to correct share the confirmation and response clock but have their own rules for the answer (regs §§ 7022 and 7023), which this tool does not draft. More on the law itself in what the CCPA is.

Other states. Every state law in the deadline calculator is here, with its own clock. Virginia’s and Iowa’s statutes were read in full for the letters, so their refusal, appeal and fee lines cite the section. For the other 12, the letter follows the same pattern and says so. The Virginia guide and the US state privacy laws overview cover who each law reaches.

Questions

Do we have to acknowledge a request before we answer it?

In California, yes: within 10 business days, saying how you will verify the person and when to expect the response (regs § 7021(a)). The GDPR sets no date, but the EDPB calls a written confirmation good practice, one that says the one-month period runs from day X to day Y (para 57). The Virginia and Iowa sections on consumer requests set no acknowledgement date.

Should the reply go by email or by post?

Under the GDPR, a request made electronically is answered electronically where possible, unless the person asks otherwise (Art. 12(3)). In California the answer goes through the consumer’s account if they have one, otherwise by mail or electronically as they choose (Civ. Code § 1798.130(a)(2)(A)), with reasonable security for the data in transit (regs § 7024(f)).

One person is covered by both the GDPR and the CCPA. Which letter do we send?

Build both and merge them. Take the earlier date, keep the GDPR’s Art. 15 rows and California’s six categories items, and keep the line each law asks for in a refusal. The builder writes one law at a time so every line can carry its own rule.

Can we send our privacy policy instead of a tailored answer?

Rarely. In California only when your answer would be the same for every consumer and the policy already says everything the answer must (regs § 7024(j)). Under the GDPR, the EDPB says the information in your notice may need tailoring to what you actually do with this person’s data.

Is a letter from this template enough to comply?

It covers the elements the rules name, but whether a reply is right depends on what you hold and what you do with it. This is information, not legal advice. Keep the letter with the request record: in California that record is kept for at least 24 months.

Related