--- title: "Data Subject Requests | Pitch" description: "Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across…" url: https://www.pitch.law/technologies/dsar-handling --- [pitch](https://www.pitch.law/) [Technology](https://www.pitch.law/technologies) [Privacy, data & AI](https://www.pitch.law/technology-categories/privacy-data-ai) # Data Subject Requests Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records. ## What it does Individuals have rights under Articles 15 to 22 GDPR: access, rectification, erasure, restriction, portability and objection. A request can arrive by email, by letter, through a form or in a customer-service chat, and the controller has one month to respond (Article 12(3)), which can be extended by two further months for complex or numerous requests. What the law requires is described in our [practical guide to access requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide). Every request gets its own file, a deadline and a clear route to an answer. The lawyer decides whether an exception applies, what to redact and what to say. ## Functions ### Logging in the client portal Your team logs a request in the client portal when it arrives, with the date of receipt, the channel, the type of right invoked and the identity of the requester. The date of receipt matters, as the one-month period runs from it. ### Identity check and clarification The record notes how the requester's identity was verified (Article 12(6) allows you to ask for additional information where there are reasonable doubts) and any clarification asked. Requests that are manifestly unfounded or excessive (Article 12(5)) are flagged for the lawyer's decision. ### Deadline tracking Each request shows the deadline and what is open. If an extension is justified, the reasons are recorded and the notice to the individual, which must be sent within the first month, is prepared for approval. ### Data export for access requests For access requests, the data held in linked records is collected into an export that the lawyer can review. The review covers what must be redacted to protect the rights of others (Article 15(4)), privileged material and information that falls outside the request. The response also has to contain the information in Article 15(1), such as purposes, recipients and retention periods, which can draw on the entry in your [record of processing](https://www.pitch.law/technologies/privacy-register). ### Erasure cascade For a request under Article 17 (the right to be forgotten), we trace the individual's data across your linked records and propose erasure or anonymisation of each. Erasure is not absolute. Article 17(3) lists exceptions, including compliance with a legal obligation and the establishment, exercise or defence of legal claims, and [retention periods](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) set by other laws may require records to be kept. The lawyer decides per record, and the reasons are logged. ### Response and file The response is drafted for review and approved before it is sent. The request, the steps and the response are stored in one file, which is your evidence if the individual complains to the authority. ## What you receive - A request file with deadline, verification, decisions and response. - A reviewed export for access and portability requests. - A record of what was erased, what was kept and the legal reason for keeping it. - A list of requests and their status for the DPO's periodic review. ### Example walk-through Take a Kortrijk gym chain that receives an email from a former member asking for all data and for deletion. The front desk logs it in the portal the same day; the deadline is shown. The record notes that identity was confirmed by matching the member's registered email and a membership number. The function collects the member's data from the linked records: contract, payments, access-card logs, newsletter preferences and two complaint tickets. The lawyer reviews the export, redacts the name of another member in a complaint, and decides that invoices stay for the period required by accounting law. We propose deleting or anonymising the rest, which the lawyer approves. The response, with the information required by Article 15 and an explanation of what was kept and why, goes out within the month. The log of requests also shows patterns, such as many requests from one channel or one recurring complaint, which the DPO can raise with management as a sign of a process that needs fixing. ## Where it is used We handle these requests as part of our [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service). It also matters after a [data breach](https://www.pitch.law/solutions/data-breach-response-enforcement), when affected individuals commonly ask what you hold about them and whether it can be deleted. See also [the 72-hour rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown). Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out. Our platform is hosted in the EU. ## In short - Requests logged in the client portal - One-month deadline visible per request - Data export for access requests - Erasure handled across all linked records - Attorney reviews before a response goes out ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) - [Solutions](https://www.pitch.law/solutions/data-breach-response-enforcement) ### [Data Breach Response](https://www.pitch.law/solutions/data-breach-response-enforcement) [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://www.pitch.law/solutions/data-breach-response-enforcement) ## Background reading - [Academy](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - [Academy](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - [Academy](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - [Academy](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) ### [The NIS2 Directive](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) [Who falls under NIS2, what the directive requires, how the 24-hour, 72-hour and one-month incident reports work and how they relate to GDPR breach notification.](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) ## More in Privacy, data & AI - ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) - ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)