{"product_id":"gdpr-registerutdrag-registrerades-rattigheter-mallpaket-2026","title":"GDPR Subject Access Request \u0026 Data Subject Rights Template Package 2026 – Word\/PDF\/Excel","description":"\n\u003ch2\u003eGDPR Data Subject Access Request \u0026amp; Data Subject Rights Template Package 2026\u003c\/h2\u003e\n\u003cp\u003e\u003cstrong\u003eComplete template package for companies and organizations that need to handle requests under Articles 15–22 of the GDPR.\u003c\/strong\u003e The package includes ready-to-use response templates for data subject access requests, rectification, erasure, restriction, data portability, objection, and automated decision-making, as well as an internal processing template, deadline\/refusal template, and an Excel tool for DSAR cases.\u003c\/p\u003e\n\n\u003cp\u003eThe template package was legally reviewed as of \u003cstrong\u003eOctober 3, 2026\u003c\/strong\u003e, and is based on the GDPR, the Swedish Authority for Privacy Protection’s (IMY) current guidance, and EDPB Guidelines 01\/2022 on the right of access.\u003c\/p\u003e\n\n\u003ch3\u003eIncluded – 15 files\u003c\/h3\u003e\n\u003cul\u003e\n\n\u003cli\u003eInternal processing template for data subject rights – Word + PDF\u003c\/li\u003e\n\n\u003cli\u003eData subject access request \/ right of access under Article 15 – Word + PDF\u003c\/li\u003e\n\n\u003cli\u003eRectification \u0026amp; completion under Articles 16 and 19 – Word + PDF\u003c\/li\u003e\n\n\u003cli\u003eErasure \u0026amp; restriction under Articles 17–19 – Word + PDF\u003c\/li\u003e\n\n\u003cli\u003eData portability under Article 20 – Word + PDF\u003c\/li\u003e\n\n\u003cli\u003eObjection \u0026amp; automated decision-making under Articles 21–22 – Word + PDF\u003c\/li\u003e\n\n\u003cli\u003eExtension, refusal, fees, and identity verification under Article 12 – Word + PDF\u003c\/li\u003e\n\n\u003cli\u003eExcel tool for cases, deadlines, system searches, recipients, objections, and decision logs\u003c\/li\u003e\n\n\n\u003c\/ul\u003e\n\n\u003ch3\u003eOne month – with proper handling of extensions\u003c\/h3\u003e\n\u003cp\u003eA request under Articles 15–22 must be handled without undue delay and normally \u003cstrong\u003ewithin one month of receipt\u003c\/strong\u003e. If the request is complex or many requests are handled simultaneously, the deadline can be extended by two further months if necessary. The data subject must then be informed of the extension and the reason within the first month.\u003c\/p\u003e\n\n\u003ch3\u003eData subject access request \/ Article 15\u003c\/h3\u003e\n\u003cp\u003eThe data subject access request template helps the organization document and provide the information required by Article 15, including:\u003c\/p\u003e\n\u003cul\u003e\n\n\u003cli\u003ewhether personal data is being processed\u003c\/li\u003e\n\n\u003cli\u003epurposes and categories of personal data\u003c\/li\u003e\n\n\u003cli\u003erecipients or categories of recipients\u003c\/li\u003e\n\n\u003cli\u003estorage period or criteria\u003c\/li\u003e\n\n\u003cli\u003erights and the right to lodge a complaint with the IMY\u003c\/li\u003e\n\n\u003cli\u003esource when data has not been collected from the person\u003c\/li\u003e\n\n\u003cli\u003eautomated decision-making\/profiling where applicable\u003c\/li\u003e\n\n\u003cli\u003ethird-country transfers and safeguards\u003c\/li\u003e\n\n\u003cli\u003ecopy of personal data in an appropriate format\u003c\/li\u003e\n\n\n\u003c\/ul\u003e\n\n\u003ch3\u003eRectification, erasure, and restriction\u003c\/h3\u003e\n\u003cp\u003eThe package includes separate response templates for Articles 16–19. The templates document not only the decision itself but also the obligation to, in relevant cases, inform recipients who previously received the data.\u003c\/p\u003e\n\u003cp\u003eThe erasure template includes both grounds for erasure and exceptions, so that the organization does not incorrectly treat the right to be forgotten as absolute. The restriction section covers, among other things, contested accuracy, unlawful processing, legal claims, and ongoing objection assessment.\u003c\/p\u003e\n\n\u003ch3\u003eData portability \/ Article 20\u003c\/h3\u003e\n\u003cp\u003eThe data portability template includes eligibility checks for specific conditions: processing must, among other things, be automated and based on consent or contract. The template also distinguishes between personal data provided by the data subject and data that falls outside of Article 20.\u003c\/p\u003e\n\n\u003ch3\u003eObjection \u0026amp; direct marketing\u003c\/h3\u003e\n\u003cp\u003eThe objection template distinguishes between regular processing under Article 21.1 and direct marketing. In the case of direct marketing, processing for that purpose must cease when the data subject objects. For other processing, a documented assessment of overriding legitimate grounds or legal claims is required.\u003c\/p\u003e\n\n\u003ch3\u003eAutomated decision-making \/ Article 22\u003c\/h3\u003e\n\u003cp\u003eThe package also includes verification of whether decisions are based solely on automated processing and have legal or similarly significant effects, as well as fields for exceptions, human intervention, the opportunity to express views, contest decisions, and provide meaningful information about the logic involved.\u003c\/p\u003e\n\n\u003ch3\u003eArticle 12 – extension, refusal, and fees\u003c\/h3\u003e\n\u003cp\u003eThe separate Article 12 template helps the organization manage situations where:\u003c\/p\u003e\n\u003cul\u003e\n\n\u003cli\u003ethe deadline needs to be extended\u003c\/li\u003e\n\n\u003cli\u003ethe request is only partially granted or is refused\u003c\/li\u003e\n\n\u003cli\u003ethe request is considered manifestly unfounded or excessive\u003c\/li\u003e\n\n\u003cli\u003eadditional identity information needs to be requested due to reasonable doubts\u003c\/li\u003e\n\n\n\u003c\/ul\u003e\n\n\u003ch3\u003eIdentity verification without over-collection\u003c\/h3\u003e\n\u003cp\u003eThe templates assume that the organization should facilitate the exercise of rights. Additional identification information should only be requested when there are reasonable doubts about the identity, and the verification must be proportionate.\u003c\/p\u003e\n\n\u003ch3\u003eExcel tool with deadline monitoring\u003c\/h3\u003e\n\u003cp\u003eThe Excel tool includes a dashboard and separate worksheets for:\u003c\/p\u003e\n\u003cul\u003e\n\n\u003cli\u003eall DSAR\/GDPR rights cases\u003c\/li\u003e\n\n\u003cli\u003eautomatic standard one-month deadline\u003c\/li\u003e\n\n\u003cli\u003eextended three-month deadline when extensions are used\u003c\/li\u003e\n\n\u003cli\u003edeadline status and overdue cases\u003c\/li\u003e\n\n\u003cli\u003esystem searches and data sources\u003c\/li\u003e\n\n\u003cli\u003eArticle 19 recipients\u003c\/li\u003e\n\n\u003cli\u003eArticle 21 objections\u003c\/li\u003e\n\n\u003cli\u003edecisions, fees, refusals, and extensions\u003c\/li\u003e\n\n\u003cli\u003elegal sources\u003c\/li\u003e\n\n\n\u003c\/ul\u003e\n\n\u003ch3\u003eEDPB guidelines on the right of access\u003c\/h3\u003e\n\u003cp\u003eThe data subject access request section considers the final version of the EDPB Guidelines 01\/2022 on the right of access. The guidelines address, among other things, how the organization should understand a request, search for relevant data, handle copies, electronic formats, and the rights of other individuals.\u003c\/p\u003e\n\n\u003ch3\u003eWho is this package for?\u003c\/h3\u003e\n\u003cul\u003e\n\n\u003cli\u003ecompanies and e-retailers\u003c\/li\u003e\n\n\u003cli\u003eSaaS and IT companies\u003c\/li\u003e\n\n\u003cli\u003eHR and personnel departments\u003c\/li\u003e\n\n\u003cli\u003ecustomer service and support\u003c\/li\u003e\n\n\u003cli\u003edata protection officers\u003c\/li\u003e\n\n\u003cli\u003ecompliance and legal departments\u003c\/li\u003e\n\n\u003cli\u003eorganizations that want a traceable and consistent process for data subject rights\u003c\/li\u003e\n\n\n\u003c\/ul\u003e\n\n\u003ch3\u003eLegal basis\u003c\/h3\u003e\n\u003cul\u003e\n\n\u003cli\u003eGeneral Data Protection Regulation (EU) 2016\/679, particularly Articles 12 and 15–22, and Article 19\u003c\/li\u003e\n\n\u003cli\u003eIMY’s current guidance on data subject rights and deadlines\u003c\/li\u003e\n\n\u003cli\u003eEDPB Guidelines 01\/2022 on data subject rights – Right of access, Version 2.1\u003c\/li\u003e\n\n\n\u003c\/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eFormat:\u003c\/strong\u003e Word (DOCX) + PDF + Excel (XLSX)\u003cbr\u003e\n\u003cstrong\u003eLanguage:\u003c\/strong\u003e Swedish\u003cbr\u003e\n\u003cstrong\u003eJurisdiction:\u003c\/strong\u003e Sweden \/ EU\u003cbr\u003e\n\u003cstrong\u003eNumber of files:\u003c\/strong\u003e 15\u003cbr\u003e\n\u003cstrong\u003eVersion:\u003c\/strong\u003e 1.0 – 2026-10-03\u003c\/p\u003e\n\n\u003cp\u003e\u003cem\u003eThe templates are general document materials. Sector-specific regulations, confidentiality, archiving rules, accounting requirements, and other legal obligations may affect how a specific request should be handled.\u003c\/em\u003e\u003c\/p\u003e\n","brand":"Svenska Dokumentmallar","offers":[{"title":"Default Title","offer_id":55591101464918,"sku":"GDPR-RATTIGHETER-2026","price":199.0,"currency_code":"SEK","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0827\/2373\/3846\/files\/gdpr-registrerades-rattigheter-mallpaket-2026.png?v=1791043090","url":"https:\/\/mallbutiken.se\/en\/products\/gdpr-registerutdrag-registrerades-rattigheter-mallpaket-2026","provider":"Mallbutiken","version":"1.0","type":"link"}