Docs / GDPR Basics for Non-Experts

GDPR Basics for Non-Experts

This guide explains GDPR data subject requests in plain English. You don’t need to be a lawyer to handle DSARs properly—just understand the basics and let SAR Portal help with the rest.

What is GDPR?

The General Data Protection Regulation (GDPR) is an EU law that gives people control over their personal data. If your business operates in the EU or handles EU citizens’ data, GDPR applies to you.

Key Concepts

Term Plain English
Data Subject Any person whose data you hold (customers, employees, contacts)
Personal Data Any information that can identify a person (name, email, IP address, etc.)
Data Controller Your organization—you decide how data is used
Processing Anything you do with data (collect, store, use, share, delete)
DSAR Data Subject Access Request—when someone asks about their data

The 8 Data Subject Rights

GDPR gives people 8 rights over their personal data. SAR Portal helps you handle requests for all of them.

1. Right of Access (Article 15)

“What data do you have about me?”

The person can ask for:

Access Request Most Common

"I'd like a copy of all personal data you hold about me."

Your obligations:

2. Right to Erasure (Article 17)

“Delete my data”

Also called the “Right to be Forgotten.” The person can request you delete their data.

When you MUST delete:

When you can REFUSE:

Example Refusal
"We cannot delete your purchase history as we're legally required to keep financial records for 7 years for tax purposes."

3. Right to Rectification (Article 16)

“My data is wrong—fix it”

People can request you correct inaccurate data or complete incomplete data.

Examples:

Your obligations:

4. Right to Restriction (Article 18)

“Stop using my data (but don’t delete it)”

A temporary “freeze” on processing while something is resolved.

When this applies:

What restriction means:

5. Right to Data Portability (Article 20)

“Give me my data in a format I can take elsewhere”

They can request their data in a machine-readable format to transfer to another service.

Applies to:

Format:

6. Right to Object (Article 21)

“Stop processing my data”

People can object to certain types of processing.

Automatic right to stop:

Can object, but you can override if:

7. Rights Related to Automated Decisions (Article 22)

“A computer made a decision about me—I want a human review”

If you make significant automated decisions (no human involvement), people can:

Examples:

8. Right to be Informed (Articles 13-14)

“Tell me what you’re doing with my data”

You must proactively tell people:

This is handled through your Privacy Policy, not through SAR Portal.

The 30-Day Deadline

Critical: 30-Day Rule
You must respond to most requests within 30 days of receiving them. This is a legal requirement, not a guideline.

Timeline

Day Action
Day 0 Receive request
Day 1-7 Acknowledge receipt, begin gathering data
Day 7-21 Process data, apply redactions
Day 21-28 Review and approve response
Day 28-30 Send response

Extensions

For complex requests, you can extend to 90 days, but you must:

  1. Notify the person within the first 30 days
  2. Explain why you need more time
  3. Document the complexity

Valid reasons for extension:

When You Can Refuse

You’re not required to fulfill every request. You can refuse if:

1. Manifestly Unfounded

The request has no basis:

2. Manifestly Excessive

The request is unreasonable:

3. Can’t Verify Identity

You must verify the person is who they claim:

4. Exemptions Apply

Certain exemptions exist:

When You Refuse
You must still respond within 30 days, explaining why you're refusing and informing them of their right to complain to the supervisory authority.

Penalties for Non-Compliance

GDPR has serious penalties:

Violation Level Maximum Fine
Lower tier €10 million or 2% of global annual turnover
Upper tier €20 million or 4% of global annual turnover

Beyond fines:

How SAR Portal Helps

SAR Portal handles the complexity so you can focus on your business:

Automated Tracking

AI-Powered Processing

Compliance Documentation

Team Collaboration

Open SAR Portal →

Quick Reference Card

When Someone Contacts You

  1. Identify the request type (access, deletion, correction, etc.)
  2. Log it immediately in SAR Portal
  3. Verify their identity if needed
  4. Gather relevant data from your systems
  5. Process and redact third-party information
  6. Respond within 30 days
  7. Document everything for compliance

Red Flags to Watch For

⚠️ Approaching deadline - Prioritize immediately ⚠️ Complex request - Consider extension ⚠️ Identity concerns - Request verification ⚠️ Third-party data - Must be redacted ⚠️ Legal implications - Consult legal team

What to Include in Your Response

Request Type What to Provide
Access Copy of all personal data + usage information
Erasure Confirmation of deletion (or valid refusal reason)
Rectification Confirmation of correction made
Restriction Confirmation of restriction applied
Portability Data in machine-readable format
Objection Confirmation processing stopped (or valid override reason)

Learn More

GDPR Articles Reference Request Types in Detail Complete Case Tutorial FAQ

Disclaimer

Not Legal Advice
This guide provides general information about GDPR. It is not legal advice. For specific legal questions, consult with a qualified legal professional or your Data Protection Officer.