Lion Cipher Lab
Track data subject access requests and flag deadline risk
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Under the GDPR (and the UK GDPR), anyone can make a data subject access request (DSAR) — a request for a copy of the personal data an organization holds about them — and the organization must respond within one calendar month, extendable by two further months only if the request is complex or there are many of them. Miss the deadline and you have a reportable compliance failure and an unhappy, often litigious, individual. A single DSAR is easy to track. The failure happens at scale: a privacy team juggling a queue of requests, each received on a different day, each with its own clock, some…
What you'll learn
- computing a GDPR one-calendar-month deadline correctly
- why a flat 30-day rule gives the wrong date
- flagging open requests that are overdue or due soon
- checking closed requests for lateness
- validating that extensions were applied only to complex requests
- running a whole DSAR queue instead of one request
Steps in this lab
- One calendar month is not thirty days
- The request queue
- Write the tracker
- Run it: what is late, what is close, and a bad extension
- Operate it, and stay in your lane