OpenDQV Cloud starter template (v0.1) — your tenant inherits this baseline. First customer edit creates v1.0 in your audit trail; pin by yaml_hash for replay. EU GDPR Article 15 — Regulation (EU) 2016/679, Data Subject Access Request (DSAR) record compliance contract. Controllers must respond to DSARs within one calendar month (extendable by two months for complex requests) per Article 12(3). This contract enforces completeness at the point of write: requester identity, receipt date, response deadline, identity verification, outcome recording, and extension justification. The omission failure mode: request received, response deadline missed because key fields were never recorded. Supervisory authority enforcement action. Administrative fines up to EUR 20M or 4% of global annual turnover under Article 83(5) for violations of data subject rights (Articles 12–22).
| Rule | Field | Severity | What it enforces (the message your team sees) |
|---|---|---|---|
| request_id_required | request_id | error | request_id is required — every DSAR must be uniquely identifiable for tracking and audit purposes |
| requester_name_required | requester_name | error | requester_name is required — the identity of the data subject making the request must be recorded |
| requester_email_required | requester_email | error | requester_email is required — a contact address is needed to deliver the response to the data subject |
| requester_email_format | requester_email | error | requester_email must be a valid email address format |
| receipt_date_required | receipt_date | error | receipt_date is required — the Article 12(3) EU GDPR one-month deadline runs from the date the request is received |
| receipt_date_format | receipt_date | error | receipt_date must be a valid date (YYYY-MM-DD) |
| response_due_date_required | response_due_date | error | response_due_date is required — record the statutory deadline (30 calendar days from receipt_date) per Article 12(3) EU GDPR |
| response_due_date_format | response_due_date | error | response_due_date must be a valid date (YYYY-MM-DD) |
| request_channel_required | request_channel | error | request_channel is required — record how the DSAR was received for audit trail purposes |
| request_channel_valid | request_channel | error | request_channel must be one of: email, post, web_form, verbal, social_media, other |
| request_type_required | request_type | error | request_type is required — record which data subject right is being exercised (Articles 15–22 EU GDPR) |
| request_type_valid | request_type | error | request_type must be one of: subject_access, rectification, erasure, restriction, portability, objection, automated_decision, other |
| id_verification_completed_required | id_verification_completed | error | id_verification_completed must be declared (true or false) — Article 12(6) EU GDPR requires identity verification before releasing personal data |
| id_verification_completed_valid | id_verification_completed | error | id_verification_completed must be 'true' or 'false' |
| id_verification_date_required_if_verified | id_verification_date | error | id_verification_date is required when id_verification_completed is true — record when the data subject's identity was verified |
| id_verification_date_format | id_verification_date | error | id_verification_date must be a valid date (YYYY-MM-DD) |
| id_verification_method_required_if_verified | id_verification_method | error | id_verification_method is required when id_verification_completed is true — record how identity was verified (e.g. passport, driving licence, digital identity) |
| extension_applied_required | extension_applied | error | extension_applied must be declared (true or false) — Article 12(3) EU GDPR permits a two-month extension for complex requests |
| extension_applied_valid | extension_applied | error | extension_applied must be 'true' or 'false' |
| extension_reason_required_if_extended | extension_reason | error | extension_reason is required when extension_applied is true — Article 12(3) EU GDPR requires the controller to inform the data subject of the reasons for the delay |
| extended_due_date_required_if_extended | extended_due_date | error | extended_due_date is required when extension_applied is true — record the revised deadline (maximum two months beyond the original due date) |
| extended_due_date_format | extended_due_date | error | extended_due_date must be a valid date (YYYY-MM-DD) |
| status_required | status | error | status is required — track the current state of the DSAR for compliance monitoring |
| status_valid | status | error | status must be one of: open, in_progress, closed, withdrawn |
| outcome_required_if_closed | outcome | error | outcome is required when status is closed — record whether the request was fulfilled, refused, partially_fulfilled, or withdrawn |
| outcome_valid | outcome | error | outcome must be one of: fulfilled, refused, partially_fulfilled, withdrawn |
| refusal_reason_required_if_refused | refusal_reason | error | refusal_reason is required when outcome is refused — Article 12(4) EU GDPR requires the controller to explain the reasons for not taking action and inform the data subject of their right to lodge a complaint with a supervisory authority |
| assigned_to_required | assigned_to | error | assigned_to is required — every DSAR must have a named handler to ensure accountability and prevent requests falling through the cracks |
| reviewed_by_required | reviewed_by | error | reviewed_by is required — record who reviewed this DSAR record for EU GDPR compliance |
| review_date_required | review_date | error | review_date is required |
| review_date_format | review_date | error | review_date must be a valid date (YYYY-MM-DD) |
Run your own data against this contract in the free trial — drop a CSV in the dashboard, no code, no credit card. Start free trial →