Every data subject access request puts a clock on your team, and every stage of it needs the right words. This guide gives UK DPOs and information governance teams eight plain English letter templates for the points where you must write to the requester, from the first acknowledgement to a refusal.
What you get
- Eight letters that cover the whole request: acknowledgement, identity verification, clarification, extension notice, full disclosure, partial disclosure with exemptions, refusal, and third party data.
- A one line when to use it and plain English guidance notes with every template, so the person sending it knows the rule behind the wording.
- Statutory references checked against the current UK GDPR, the Data Protection Act 2018 and ICO guidance, including the Article 12A extension and clarification rules.
- A one page quick guide that links each template to the five stages of the DSAR process.
- Bracketed placeholders for organisation details, dates and reference numbers, so each letter is quick to adapt to the case.
The eight templates
- Acknowledgement of a request
- Request for identity verification
- Request for clarification, including where you hold a large amount of information
- Extension notice, for up to two further months, with reasons
- Full disclosure covering letter
- Partial disclosure with exemptions applied
- Refusal, or manifestly unfounded or excessive response, including the right to complain to the ICO and to seek a judicial remedy
- Third party data response
Who it is for
UK DPOs, data protection managers and information governance teams who handle data subject access requests under UK GDPR and want consistent, defensible wording at each stage.
See how the five stages fit together
Each template is linked to a stage of the DSAR process: understand, scope, review and redact, apply exemptions, and disclose and report. Read the full process on the ProvePrivacy DSAR hub.
This is general guidance, not legal advice. Adapt each letter to the case, and take legal advice where the issues are complex.
Book a demo of the ProvePrivacy platform for DSARs
See how the ProvePrivacy platform takes a request from intake to disclosure, with DSAR case management, a built in redaction tool, MI dashboards and an audit trail of every decision.
