GDPR DSAR EN - data subject rights requests (Art. 12, 15-22)

Philosophy

A rights request is a clock plus a legal assessment, not an automation. The skill classifies, tracks the deadline and produces a draft; the fulfil/refuse decision and the act of sending belong to the controller. Erasure/export is irreversible/outward => always a human (governance boundary).

Step 0 - Identity and deadline

• Identity verification (Art. 12(6)) - where reasonable doubt exists, request further information. This does NOT pause the clock unconditionally: per EDPB Guidelines 01/2022 the deadline may be suspended only where the information is necessary to confirm identity AND the controller asked for it without undue delay. Preserve the original receipt date in the register - a late or disproportionate identity request does not extend the deadline, and verification must not obstruct.
• DEADLINE: without undue delay and in any event within one month of receipt (Art. 12(3)) - the month is the outer limit. Extension of up to 2 further months where necessary, taking into account the complexity and number of the requests - inform the person within the first month, with the reasons for the delay. The skill computes deadline_1_month and deadline_extended_3_months.
• Free of charge by default (Art. 12(5)). A reasonable fee or a refusal is allowed only where the request is manifestly unfounded or excessive (in particular repetitive) - the burden of proof is on the controller.

Step 1 - Classify the right

Step 2 - Gates and refusal grounds

Check right-specific exemptions (especially Art. 17(3) and national restrictions). If the controller does not act, it informs the person without delay and at the latest within one month of receipt of the reasons, and of the right to lodge a complaint with the SA and to seek a judicial remedy (Art. 12(4)).

Step 3 - Draft response + register

The skill drafts the response (plain language, Art. 12(1)), tailored to the right invoked. For Art. 15 that means a copy of the personal data retrieved from the operational systems that hold it, plus available source information (Art. 15(1)(g)) - the RoPA ([[gdpr-ropa-dpa-en]]) supplies only the general processing information (purposes, categories, recipients), not the person's data itself. Plus a register entry (receipt date, type, deadline, outcome).

Tool - deadline calculator (deterministic, offline)

Do not compute the one-month deadline by hand - month arithmetic has traps (receipt 31 Jan => ends 28/29 Feb, per Regulation (EEC) No 1182/71). Use the script (zero dependencies, offline):

python scripts/gdpr_deadlines.py dsar --from 2026-01-31 --extend

Returns deadline_1_month and (with --extend) deadline_extended_3_months. The script does not move a date that falls on a Saturday, Sunday or public holiday (Regulation (EEC) No 1182/71 art. 3(4)), so its result can be earlier than the legal limit, never later. Paste it into the response and register.

Governance boundary

Skill: classifies, computes deadlines, drafts, maintains the register. Human: verifies identity, decides fulfil/refuse, performs the erasure/export, sends the response. Irreversible and outward acts are never automatic.

Companion

Records of processing (where the data is): [[gdpr-ropa-dpa-en]]. Polish parity: rodo-dsar-pl.

Shared rules of the data-protection plugin (Data protection)

These rules apply to every skill in this plugin, including where the skill itself is silent. They are copied into each skill, so they hold whether you install the whole plugin or a single skill.

These skills run GDPR operations for controllers, law firms and DPOs: impact assessments, breach response, data subject rights, records of processing and processor-contract review. Each ends in a draft for decision, not a finished act.

Rules

• Output is a draft for decision. A DPIA, a breach notification, a DSAR response, a register or a contract redline is a starting point for the controller / DPO. A person approves and executes it.
• Governance boundary - the outward act stays human. Filing with the supervisory authority, sending a breach notification, sending a DSAR response, erasing or exporting data, signing a contract - the skill prepares the draft, it does not perform the act.
• No guessing on risk. A risk assessment (DPIA, breach) needs inputs; a missing input is a gap to fill, not a field to guess.
• Not legal advice. The skills organise GDPR obligations and map them to articles; they do not replace legal analysis of a specific matter.
• Confidentiality. Treat the data of a real organisation and of data subjects as confidential - do not move it outside the agreed flow. These skills add no outbound channel of their own; what reaches your model is decided by your configuration (see https://github.com/matematicsolutions/awesome-matematic-skills-en/blob/main/TRUST.md).

Plugin scope

Operational GDPR tooling (DPIA, breach, DSAR, RoPA/DPA). It does not verify citations or fetch sources of law - use verification-foundation and eu-law-sources for that. The DPA redline pairs with clause-checklist-en (verification-foundation).