> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Organisation: Acme Inc

DPO / Privacy Contact: dpo@acme-saas.com

Created: 2026-03-19

Applicable Regulations: GDPR

> This template provides a structured log for recording and tracking all Data Subject Access Requests (DSARs). Maintaining this log is required under GDPR Article 12(5) to demonstrate compliance with data subject rights obligations. Each request must be documented from receipt through completion.

## Request Type Reference

Code | Type | Deadline (days) | Description
--- | --- | --- | ---

## Status Values

Status | Description
--- | ---
Received | Request received, awaiting identity verification
Verifying | Identity verification in progress
In Progress | Verified; gathering data or executing request
Extended | Deadline extended (complex request, max +60 days GDPR / +45 days CCPA)
Completed | Request fulfilled, response sent to subject
Denied | Request denied with documented reason (e.g. manifestly unfounded)
Closed | Completed and archived

## DSAR Log

> Copy and append a new row for each incoming request.

ID | Date Received | Type | Data Subject | Channel | Status | Due Date | Completed | Handler | Notes
--- | --- | --- | --- | --- | --- | --- | --- | --- | ---
DSAR-001 |  | _ | __ | Email / Form / Phone | Received |  |  | _ |
DSAR-002 |  | _ | __ | Email / Form / Phone | Received |  |  | _ |
DSAR-003 |  | _ | __ | Email / Form / Phone | Received |  |  | _ |
DSAR-004 |  | _ | __ | Email / Form / Phone | Received |  |  | _ |
DSAR-005 |  | _ | __ | Email / Form / Phone | Received |  |  | _ |

## Identity Verification Log

> Before processing any DSAR, verify the identity of the requester to prevent unauthorised disclosure.

DSAR ID | Verification Method | Verified By | Verified Date | Outcome
--- | --- | --- | --- | ---
DSAR-001 | ID document / Account login / Knowledge-based | _ |  | Confirmed / Denied
DSAR-002 | ID document / Account login / Knowledge-based | _ |  | Confirmed / Denied
DSAR-003 | ID document / Account login / Knowledge-based | _ |  | Confirmed / Denied

## Data Locations by Service

> When fulfilling a DSAR, data must be gathered from all services that store personal data.

Service | Category | Data Collected | Action Required
--- | --- | --- | ---
@sentry/node | monitoring | error data, stack traces, user context, device information, IP address | Export / Delete / Rectify
@supabase/supabase-js | auth | email, password hash, session data, user metadata | Export / Delete / Rectify
openai | ai | user prompts, conversation history, generated content | Export / Delete / Rectify
posthog | analytics | user behavior, session recordings, feature flag usage, device information | Export / Delete / Rectify
prisma | database | user data as defined in schema | Export / Delete / Rectify
resend | email | email addresses, email content | Export / Delete / Rectify
stripe | payment | payment information, billing address, email, transaction history | Export / Delete / Rectify
stripe-ios | payment | payment information, billing address, email, transaction history | Export / Delete / Rectify

## Response Tracking

DSAR ID | Response Date | Response Method | Data Provided | Exemptions Applied | Sent By
--- | --- | --- | --- | --- | ---
DSAR-001 |  | Email / Portal / Post | Yes / Partial | None / Art. 17(3) | _
DSAR-002 |  | Email / Portal / Post | Yes / Partial | None / Art. 17(3) | _
DSAR-003 |  | Email / Portal / Post | Yes / Partial | None / Art. 17(3) | _

## Deadline Extensions

> GDPR allows a 60-day extension for complex requests (Art. 12(3)). CCPA allows a 45-day extension. Extensions must be communicated to the data subject within the original deadline.

DSAR ID | Original Due Date | Extended Due Date | Reason | Subject Notified | Notified Date
--- | --- | --- | --- | --- | ---
_ |  |  | Complex request / Multiple systems | Yes / No |

## Denial Log

> Requests may be denied if manifestly unfounded or excessive (GDPR Art. 12(5)). Document the reason and inform the data subject of their right to complain to a supervisory authority.

DSAR ID | Denial Date | Reason | Legal Basis | Subject Informed | Supervisory Authority Info Provided
--- | --- | --- | --- | --- | ---
_ |  | __ | Art. 12(5) / Art. 17(3) | Yes | Yes

## Monthly DSAR Summary

> Complete this section at the end of each month to track DSAR volume and performance.

### Month: Year:

Metric | Count
--- | ---
Total requests received | _
Access requests (ACC) | _
Erasure requests (ERA) | _
Rectification requests (REC) | _
Portability requests (POR) | _
Restriction requests (RES) | _
Objection requests (OBJ) | _
Completed within deadline | _
Completed with extension | _
Denied | _
Still open | _
Average response time (days) | _

Reported by: _

Date: _

## Quarterly DSAR Report

### Quarter: Q Year: __

Month | Received | Completed | On-Time % | Avg Response (days) | Denied
--- | --- | --- | --- | --- | ---
Month 1 | _ | _ | _% | _ | _
Month 2 | _ | _ | _% | _ | _
Month 3 | _ | _ | _% | _ | _
Total | _ | _ | _% | _ | _

Trends and Observations:

1. _
2. _
3. _

Reviewed by: _

Date: _

## Response Deadlines Reference

Regulation | Standard Deadline | Maximum Extension | Total Maximum
--- | --- | --- | ---

This DSAR Log Template was generated by Codepliant based on automated code analysis. It implements record-keeping requirements under GDPR Article 12(5) and CCPA operational tracking. Adapt this template to your specific organisational needs and have it reviewed by your data protection officer or legal counsel.