Lion Cipher Lab

Fulfil a GDPR DSAR (right of access) within the deadline

• GRC / Compliance
• Intermediate
• ~60 min
• Free · no account required

Why it matters

A Data Subject Access Request - a DSAR - is the single most common privacy request an organisation receives: a person exercising their GDPR Article 15 right of access, asking 'what personal data do you hold about me, and give me a copy.' It is a right any customer, employee or website visitor can invoke for free, in any words, to anyone at the company, and it starts a legal clock the moment it arrives: one month to respond under Article 12(3). Mishandled DSARs are a leading source of complaints to regulators, because they are deceptively hard - the data is scattered across systems that were…

What you'll learn

• what a Data Subject Access Request (DSAR) is and that it is the GDPR Article 15 right of access, not a request to delete (that is Article 17)
• computing the statutory response deadline from Article 12(3): one month from receipt, plus the two-further-month extension for complex or numerous requests, using the ICO corresponding-date rule
• logging a request with a received-date and turning it into a live deadline clock (days remaining, on-track vs breach) in Python
• verifying a requester's identity proportionately under Article 12(6) - confirming who they are without turning verification into an obstacle
• searching several disconnected systems (CRM, support tickets, marketing, access logs) for one person's personal data by identifier
• redacting THIRD-PARTY personal data from the results - other people's data caught in the same ticket thread - as a real, counted step grounded in Article 15(4) and Recital 63
• packaging the Article 15(1) information (purposes, categories of data, recipients, retention, the other rights, the source of the data) alongside a copy of the data itself
• the judgment: access is not erasure; you may refuse or charge only for a 'manifestly unfounded or excessive' request (Article 12(5)); identity checks must be proportionate; and exemptions (others' rights, legal privilege) exist

Steps in this lab

1. What a DSAR is - the Article 15 right of access, and what today's job is
2. Set up: confirm Python and generate Cadence's synthetic systems
3. Step 1 - LOG the request and compute the deadline (Article 12(3))
4. Step 2 - VERIFY identity, proportionately (Article 12(6))
5. Step 3 - SEARCH every system for the subject's personal data
6. Step 4 - REDACT third-party personal data (Article 15(4), Recital 63)
7. Step 5 - PACKAGE the Article 15(1) information plus a copy of the data
8. Step 6 - the deadline clock: days remaining, on-track or breach
9. Judgment: access is not erasure, refusal, fees, and proportion
10. What you built - and the reflex to keep

Open the full interactive lab →