DSAR Record Keeping: Building an Audit Trail for Compliance

Your DSAR Response Is Only as Good as Your Records

Responding to a DSAR correctly is half the job. Proving you responded correctly is the other half. Without records, you have no evidence that you searched the right systems, applied exemptions properly, met your deadline, or verified the requester's identity before handing over personal data.

Regulators do not take your word for it. When the ICO investigates a complaint about a DSAR response, they ask for documentation. When a data subject challenges your response, they expect you to demonstrate what you did, when you did it, and why. If your records are thin — or nonexistent — you are in a weak position even if you handled the request perfectly.

This guide covers what to record, how to structure your DSAR log, how long to keep records, and how a solid audit trail protects you during investigations.

Why Keep DSAR Records?

Regulatory Accountability

GDPR Article 5(2) establishes the accountability principle: you must be able to demonstrate compliance, not just assert it. The UK GDPR mirrors this requirement. Maintaining records of how you handled each DSAR is a core part of meeting this obligation.

The ICO's right of access guidance explicitly recommends keeping a log of requests received and how they were dealt with. The CCPA requires businesses to maintain records of consumer requests and how they were responded to for at least 24 months.

Complaint Defense

When a data subject complains to a regulator, the burden falls on you to show you handled their request properly. A well-maintained audit trail provides:

• Evidence you received the request and started processing it promptly
• Proof that identity verification was performed before data was disclosed
• Documentation of which systems were searched and what was found
• Justification for any exemptions applied or data withheld
• Confirmation that the response was sent within the statutory deadline

Without this evidence, a "he said, she said" dispute with a complainant will likely be resolved against you.

Internal Improvement

DSAR records also serve an operational purpose. Over time, your log reveals patterns: which systems take longest to search, which types of requests are most common, where bottlenecks occur, and whether your process is improving or degrading. This data is valuable for refining your DSAR workflow.

What to Record for Every DSAR

At minimum, your audit trail should capture the following for each request:

Request Details

• Request ID: A unique identifier (DSAR-001, DSAR-002, etc.)
• Date received: The exact date the request arrived — this starts your deadline clock
• Channel received: Email, web form, phone, post, social media, in person
• Requester name and contact information: How you identify and reach the requester
• Nature of request: Access, erasure, correction, restriction, portability, objection, or a combination
• Applicable regulation(s): GDPR, UK GDPR, CCPA, PIPEDA, or other — this determines your deadline and procedural requirements
• Deadline date: Calculated from the date received per the applicable regulation

Identity Verification

• Verification method used: What you asked for and what the requester provided
• Date verification was completed: When you confirmed identity
• Verification outcome: Confirmed, additional verification requested, or unable to verify
• Notes on proportionality: Why the level of verification was appropriate given the sensitivity of the data

Data Search

• Systems searched: A list of every system, tool, and data store you searched
• Date(s) of search: When each system was searched
• Results per system: What personal data was found (or a note confirming nothing was found)
• Person(s) who conducted the search: Who did the work
• Search methods used: What identifiers were searched (name, email, account number, etc.)

Review and Decision

• Exemptions considered: Which exemptions were reviewed and whether they applied
• Exemptions applied: Specific exemptions relied upon, with the legal basis cited (e.g., GDPR Article 15(4) — rights of others, or DPA 2018 Schedule 2 Part 3 — legal professional privilege)
• Redactions made: What was redacted and why
• Data withheld: What was not disclosed and the specific justification
• Third-party data handling: How third-party personal data in the same records was treated
• Decision maker: Who made the decisions on exemptions and redactions

Response

• Date response sent: Proof of meeting (or missing) the deadline
• Response method: How the response was delivered (encrypted email, secure file share, post, etc.)
• Contents of response: A copy of the cover letter and the data provided
• Any correspondence with the requester: Follow-up questions, clarifications, extension notices

Extensions

• Extension invoked: Yes/No
• Date extension communicated: When the requester was notified
• Reason for extension: Documented justification (complexity, volume, clarification needed)
• New deadline date: The extended deadline

Building a Simple DSAR Log

You do not need expensive software to maintain a DSAR audit trail. A structured spreadsheet works well for most organizations handling moderate volumes.

Spreadsheet Approach

Create a spreadsheet with the following tabs:

Tab 1: Request Log. One row per DSAR. Columns for request ID, date received, requester details, request type, regulation, deadline, status, assigned to, date completed.

Tab 2: Verification Log. One row per verification action. Columns for request ID, verification method, date requested, date completed, outcome, notes.

Tab 3: Search Log. One row per system searched per request. Columns for request ID, system name, date searched, searched by, results found (yes/no), notes.

Tab 4: Decision Log. One row per exemption or redaction decision. Columns for request ID, data item, decision (disclose/withhold/redact), legal basis, decided by, date, notes.

File Folder Approach

For each DSAR, create a folder (digital or physical) containing:

• A copy of the original request
• Verification records
• Your search checklist (marked up with results)
• Copies of data found in each system
• The final response package (cover letter and data)
• Any correspondence with the requester
• A decision log noting exemptions and redactions

Link the folder to the corresponding row in your spreadsheet log.

Automated Logging

If you use DSAR management software, it should generate audit trails automatically. Verify that it captures all the elements listed above. If it does not, supplement it with manual records for the gaps.

For guidance on when to invest in automation, see our automation guide.

How Long to Retain DSAR Records

There is no single retention period that applies universally. The right answer depends on the regulations you operate under and the risk profile of your business.

CCPA: At Least 24 Months

The CCPA explicitly requires businesses to maintain records of consumer requests and their responses for at least 24 months (Cal. Code Regs. tit. 11, § 7101).

GDPR and UK GDPR: No Specific Period

Neither the GDPR nor the UK GDPR specifies a retention period for DSAR records. However, you should retain them long enough to:

• Defend against complaints (individuals can complain to a supervisory authority at any time, though authorities typically investigate complaints about recent events)
• Respond to regulatory audits
• Demonstrate ongoing accountability

Practical Recommendation

Most privacy professionals recommend retaining DSAR records for three to six years. Three years covers most regulatory investigation timelines and standard limitation periods for complaints. Six years aligns with the general contractual limitation period in England and Wales (Limitation Act 1980, Section 5) and similar periods in other jurisdictions.

The retention period should be documented in your privacy framework so it is consistently applied and defensible.

What to Delete Eventually

DSAR records themselves contain personal data — the requester's identity, potentially copies of their personal data, and details about your processing. Keeping them indefinitely would itself be a data protection issue. Set a retention period, apply it consistently, and securely destroy records when the period expires.

How Audit Trails Protect You During Investigations

When a supervisory authority investigates a DSAR complaint, the investigation typically follows a predictable pattern:

1. The authority asks for your account of events. They want to know when you received the request, what you did, and when you responded. Your DSAR log provides this immediately.

2. They ask for evidence of your process. Did you verify identity? Which systems did you search? How did you determine which exemptions applied? Your search log, verification records, and decision log answer these questions.

3. They assess whether your response was adequate. Did you provide all the data you should have? Did you properly apply exemptions? Were your redactions justified? Your records show your reasoning.

4. They check your timeline. Was the response sent within the statutory deadline? If you needed an extension, did you communicate it properly? Date-stamped records prove compliance.

Without these records, each of these steps becomes a problem. The authority has only the complainant's account to work with, and their account will naturally favor their position. Your audit trail is your defense.

Real-World Enforcement Examples

Regulators have penalized organizations not just for handling DSARs incorrectly, but for failing to demonstrate they handled them correctly. The ICO has issued reprimands and enforcement notices in cases where organizations could not produce evidence of their DSAR handling process, even when the underlying response may have been adequate.

The lesson is clear: doing the right thing is not enough if you cannot prove you did the right thing.

Common Record-Keeping Mistakes

Recording too little. A log that says "Received request, responded on [date]" is nearly useless during an investigation. Record the detail — verification steps, systems searched, decisions made, and reasoning.

Recording too late. Update your records as you go, not after the fact. Reconstructing an audit trail from memory days or weeks later is unreliable and looks bad to investigators.

Not recording refusals. If you refuse a request or withhold data, the record of why is even more important than for straightforward disclosures. Document the specific exemption, the legal basis, and the reasoning.

Storing records insecurely. DSAR records contain personal data and details about your processing activities. They need the same level of security as any other personal data. Access should be limited to those who need it.

Not having a retention policy for the records themselves. DSAR records are personal data. Keeping them forever is itself a compliance issue. Set a retention period and apply it.

Related Guides

• Building a DSAR Workflow — the end-to-end process
• DSAR Response Deadlines — deadlines across jurisdictions
• Automating Data Privacy Compliance — when automation makes sense

References

• GDPR Article 5(2): Accountability principle. GDPR Article 5
• CCPA Record-Keeping: Cal. Code Regs. tit. 11, § 7101. California Code of Regulations
• ICO Right of Access Guidance: ICO guidance