Build an intake form or API endpoint to receive DSARs; collect the requestor's identity, contact details, and the nature of their request (access, rectification, erasure, portability, restriction), then acknowledge receipt automatically within 24 hours.
Verify the requestor's identity before disclosing data; for web app users, confirmation of authenticated session is often sufficient, but for third-party requests require additional verification to avoid disclosing to bad actors.
Fan out the data-discovery query across all systems of record (databases, CRMs, analytics platforms, backups, email archives, third-party processors) by searching on email, user ID, and any other known identifiers for that person.
Compile the response package: a structured export of all personal data found, including its categories, sources, processing purposes, and any third parties it has been shared with, formatted in a portable machine-readable format (JSON or CSV) where portability is requested.
Respond to the requestor within 30 days (extendable by 60 days for complex requests with notice); document the entire workflow including verification, data found, and response timestamp in a DSAR register.
Known gotchas
The 30-day clock starts from receipt of the request, not from identity verification; if verification delays the process, document why and extend the deadline formally with notice to the requestor.
Erasure requests conflict with legal retention obligations (e.g., financial records, employment records); you must identify and document which data is retained under a legal basis and which is deleted rather than erasing indiscriminately.
This workflow describes technical implementation steps and is not legal advice; your DSAR process should be reviewed by a data protection officer or privacy attorney to ensure compliance with applicable law.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp