GDPR Subject Access Request & Data Subject Rights Template Package 2026 – Word/PDF/Excel

GDPR Data Subject Access Request & Data Subject Rights Template Package 2026

Complete template package for companies and organizations that need to handle requests under Articles 15–22 of the GDPR. The package includes ready-to-use response templates for data subject access requests, rectification, erasure, restriction, data portability, objection, and automated decision-making, as well as an internal processing template, deadline/refusal template, and an Excel tool for DSAR cases.

The template package was legally reviewed as of October 3, 2026, and is based on the GDPR, the Swedish Authority for Privacy Protection’s (IMY) current guidance, and EDPB Guidelines 01/2022 on the right of access.

Included – 15 files

• Internal processing template for data subject rights – Word + PDF
• Data subject access request / right of access under Article 15 – Word + PDF
• Rectification & completion under Articles 16 and 19 – Word + PDF
• Erasure & restriction under Articles 17–19 – Word + PDF
• Data portability under Article 20 – Word + PDF
• Objection & automated decision-making under Articles 21–22 – Word + PDF
• Extension, refusal, fees, and identity verification under Article 12 – Word + PDF
• Excel tool for cases, deadlines, system searches, recipients, objections, and decision logs

One month – with proper handling of extensions

A request under Articles 15–22 must be handled without undue delay and normally within one month of receipt. If the request is complex or many requests are handled simultaneously, the deadline can be extended by two further months if necessary. The data subject must then be informed of the extension and the reason within the first month.

Data subject access request / Article 15

The data subject access request template helps the organization document and provide the information required by Article 15, including:

• whether personal data is being processed
• purposes and categories of personal data
• recipients or categories of recipients
• storage period or criteria
• rights and the right to lodge a complaint with the IMY
• source when data has not been collected from the person
• automated decision-making/profiling where applicable
• third-country transfers and safeguards
• copy of personal data in an appropriate format

Rectification, erasure, and restriction

The package includes separate response templates for Articles 16–19. The templates document not only the decision itself but also the obligation to, in relevant cases, inform recipients who previously received the data.

The erasure template includes both grounds for erasure and exceptions, so that the organization does not incorrectly treat the right to be forgotten as absolute. The restriction section covers, among other things, contested accuracy, unlawful processing, legal claims, and ongoing objection assessment.

Data portability / Article 20

The data portability template includes eligibility checks for specific conditions: processing must, among other things, be automated and based on consent or contract. The template also distinguishes between personal data provided by the data subject and data that falls outside of Article 20.

Objection & direct marketing

The objection template distinguishes between regular processing under Article 21.1 and direct marketing. In the case of direct marketing, processing for that purpose must cease when the data subject objects. For other processing, a documented assessment of overriding legitimate grounds or legal claims is required.

Automated decision-making / Article 22

The package also includes verification of whether decisions are based solely on automated processing and have legal or similarly significant effects, as well as fields for exceptions, human intervention, the opportunity to express views, contest decisions, and provide meaningful information about the logic involved.

Article 12 – extension, refusal, and fees

The separate Article 12 template helps the organization manage situations where:

• the deadline needs to be extended
• the request is only partially granted or is refused
• the request is considered manifestly unfounded or excessive
• additional identity information needs to be requested due to reasonable doubts

Identity verification without over-collection

The templates assume that the organization should facilitate the exercise of rights. Additional identification information should only be requested when there are reasonable doubts about the identity, and the verification must be proportionate.

Excel tool with deadline monitoring

The Excel tool includes a dashboard and separate worksheets for:

• all DSAR/GDPR rights cases
• automatic standard one-month deadline
• extended three-month deadline when extensions are used
• deadline status and overdue cases
• system searches and data sources
• Article 19 recipients
• Article 21 objections
• decisions, fees, refusals, and extensions
• legal sources

EDPB guidelines on the right of access

The data subject access request section considers the final version of the EDPB Guidelines 01/2022 on the right of access. The guidelines address, among other things, how the organization should understand a request, search for relevant data, handle copies, electronic formats, and the rights of other individuals.

Who is this package for?

• companies and e-retailers
• SaaS and IT companies
• HR and personnel departments
• customer service and support
• data protection officers
• compliance and legal departments
• organizations that want a traceable and consistent process for data subject rights

Legal basis

• General Data Protection Regulation (EU) 2016/679, particularly Articles 12 and 15–22, and Article 19
• IMY’s current guidance on data subject rights and deadlines
• EDPB Guidelines 01/2022 on data subject rights – Right of access, Version 2.1

Format: Word (DOCX) + PDF + Excel (XLSX)
Language: Swedish
Jurisdiction: Sweden / EU
Number of files: 15
Version: 1.0 – 2026-10-03

The templates are general document materials. Sector-specific regulations, confidentiality, archiving rules, accounting requirements, and other legal obligations may affect how a specific request should be handled.