DSAR template letters

1. Acknowledgement

Send this as soon as a request arrives — a prompt, correct acknowledgement starts the clock cleanly.

Subject: We've received your data request

Hello [requester name],

Thank you for your request regarding your personal data. We received it on [date].

What happens next:
1. We verify your identity within 7 days.
2. After verification, your request is handled by [your company].
3. We respond within one month of verifying your identity, as required by
   Article 12 GDPR. Complex requests may be extended by up to two further
   months — we will tell you if so, and why.

Reference: [request ID]

If you believe your rights are not being respected, you may contact your local
Data Protection Authority.

2. Identity verification

Use this when you have reasonable doubt about who is asking. Keep verification proportionate — it must not become an obstacle.

Subject: Verifying your identity for your data request

Hello [requester name],

Before we can act on your request, we need to confirm your identity — this
protects your data from being disclosed to the wrong person.

Please reply from the email address associated with your account, or provide
[describe the minimum proportionate verification you need].

We will not use this information for any purpose other than verifying your
identity. Once confirmed, the one-month response period begins.

3. Response

The substantive reply, due within one month of identity verification (extendable by two months for complex requests under Article 12(3)).

Subject: Response to your data request — [request ID]

Hello [requester name],

We have completed your request of [date].

[For access: A copy of your personal data is attached / available here. It
includes the categories of data, the purposes of processing, who it is shared
with, and the retention period.]

[For erasure / rectification / restriction / objection: describe the action
taken, or explain any legal grounds for not fully complying — e.g. statutory
retention obligations.]

If you have questions about this response, reply to this email. You also have
the right to lodge a complaint with your local Data Protection Authority.

How Usantis handles this for you

If Usantis is your EU representative, we receive the request, verify identity, translate it where needed and forward it with the deadline tracked — you provide the substantive answer. See data subject rights.