Sample DSAR Evidence Pack
See exactly what a complete, GDPR-compliant DSAR response looks like. This is what you'll produce with SAR Portal - and what regulators expect to see.
1 Request Intake
When a data subject submits a request, SAR Portal captures all required information and starts the 30-day countdown automatically.
📄 Data Subject Access Request
GDPR Article 152 Identity Verification
Before releasing any personal data, you must verify the requester's identity. SAR Portal documents this critical step.
👤 Identity Verification Record
✓ Verified3 Redacted Documents
Third-party personal data must be redacted before disclosure. SAR Portal's AI identifies and redacts this automatically.
📄 Customer Support Transcript (Redacted)
PDF - 2 pagesSupport Ticket #4521 - 23 October 2024
Customer: Sarah Mitchell (sarah.mitchell@email.com)
Agent: ████████████
Sarah Mitchell: Hi, I'm having trouble accessing my account. It says my password is incorrect but I'm sure it's right.
████████: Hello Sarah! I'd be happy to help you with that. I can see your account was locked after 3 failed login attempts at 14:32 today. Let me unlock it for you.
Sarah Mitchell: Oh, that must have been me trying different passwords. Thank you!
████████: No problem! I've unlocked your account. You should receive a password reset email at sarah.mitchell@email.com within the next few minutes. Is there anything else I can help you with?
Sarah Mitchell: No, that's everything. Thanks for your help!
Redaction note: Agent name redacted as third-party personal data (GDPR Article 15(4))
📄 Account Information Export
PDF - 1 page4 Final Response
The complete response package sent to the data subject, fulfilling your Article 15 obligations.
📧 Response Letter
✓ SentAcme Corporation Ltd
123 Business Park, London, EC1A 1BB
dpo@acme-corp.com
5 December 2024
Dear Ms Mitchell,
Re: Your Data Subject Access Request (Ref: SAR-2024-00147)
Thank you for your request dated 15 November 2024 for access to your personal data under Article 15 of the UK GDPR.
We have completed our search of our systems and are pleased to enclose the following:
Enclosed Documents:
- Account Information Export (1 page)
- Customer Support Transcripts (2 pages, redacted)
- Transaction History (3 pages)
- Marketing Preferences Record (1 page)
Information about processing:
- Purposes: Service delivery, customer support, marketing (with consent)
- Legal basis: Contract performance, legitimate interests, consent
- Recipients: Stripe (payments), Mailchimp (marketing)
- Retention: Account data retained for 7 years after account closure
- Your rights: Rectification, erasure, restriction, portability, objection
Please note that some information has been redacted to protect the personal data of third parties (our employees), as permitted under Article 15(4).
If you have any questions about this response or wish to exercise any other rights, please contact us at dpo@acme-corp.com.
Yours sincerely,
John Smith
Data Protection Officer
Acme Corporation Ltd
5 Complete Audit Trail
Immutable record of every action taken - exactly what a regulator would request during an investigation.
📋 Audit Log - Case SAR-2024-00147
Immutable RecordWant to know how we protect your data?
Learn about our security measures, GDPR compliance, and data residency options.
Visit Trust Center →Ready to produce evidence packs like this?
Start your 14-day free trial and handle your first DSAR with complete audit trails and AI-powered redaction.
No credit card required. Full access to all features.