Starter contract

gdpr_dsar_request

31 rules · pairs with gdpr_processing_record (29) — 60 together · plain YAML · starts in observation mode

OpenDQV Cloud starter template (v0.1) — your tenant inherits this baseline. First customer edit creates v1.0 in your audit trail; pin by yaml_hash for replay. UK GDPR Article 15 / Data Protection Act 2018 Part 2 — Data Subject Access Request (DSAR) record compliance contract. Controllers must respond to DSARs within one calendar month (extendable by two months for complex requests). This contract enforces completeness at the point of write: requester identity, receipt date, response deadline, identity verification, outcome recording, and extension justification. The omission failure mode: request received, response deadline missed because key fields were never recorded. ICO enforcement action. Fines up to £17.5M or 4% of global annual turnover.

These are starting points you own. Every rule below ships in the trial, starts in observation mode, and is yours to read, edit, or delete from day one. Rules that reference a lookup list (lookup_file) validate against reference data you control in your tenant.
Rules as at 29 August 2026 — starting points you own, not a maintained regulatory feed. We correct errors in these samples; tracking regulatory change in your active contracts is yours.

Rule	Field	Severity	What it enforces (the message your team sees)
request_id_required	request_id	error	request_id is required — every DSAR must be uniquely identifiable for tracking and audit purposes
requester_name_required	requester_name	error	requester_name is required — the identity of the data subject making the request must be recorded
requester_email_required	requester_email	error	requester_email is required — a contact address is needed to deliver the response to the data subject
requester_email_format	requester_email	error	requester_email must be a valid email address format
receipt_date_required	receipt_date	error	receipt_date is required — the Article 12(3) UK GDPR one-month deadline runs from the date the request is received
receipt_date_format	receipt_date	error	receipt_date must be a valid date (YYYY-MM-DD)
response_due_date_required	response_due_date	error	response_due_date is required — record the statutory deadline (one calendar month from receipt_date) per Article 12(3) UK GDPR
response_due_date_format	response_due_date	error	response_due_date must be a valid date (YYYY-MM-DD)
request_channel_required	request_channel	error	request_channel is required — record how the DSAR was received for audit trail purposes
request_channel_valid	request_channel	error	request_channel must be one of: email, post, web_form, verbal, social_media, other
request_type_required	request_type	error	request_type is required — record which data subject right is being exercised (Articles 15–22 UK GDPR)
request_type_valid	request_type	error	request_type must be one of: subject_access, rectification, erasure, restriction, portability, objection, automated_decision, other
id_verification_completed_required	id_verification_completed	error	id_verification_completed must be declared (true or false) — Article 12(6) UK GDPR requires identity verification before releasing personal data
id_verification_completed_valid	id_verification_completed	error	id_verification_completed must be 'true' or 'false'
id_verification_date_required_if_verified	id_verification_date	error	id_verification_date is required when id_verification_completed is true — record when the data subject's identity was verified
id_verification_date_format	id_verification_date	error	id_verification_date must be a valid date (YYYY-MM-DD)
id_verification_method_required_if_verified	id_verification_method	error	id_verification_method is required when id_verification_completed is true — record how identity was verified (e.g. passport, driving licence, digital identity)
extension_applied_required	extension_applied	error	extension_applied must be declared (true or false) — Article 12(3) UK GDPR permits a two-month extension for complex requests
extension_applied_valid	extension_applied	error	extension_applied must be 'true' or 'false'
extension_reason_required_if_extended	extension_reason	error	extension_reason is required when extension_applied is true — Article 12(3) UK GDPR requires the controller to inform the data subject of the reasons for the delay
extended_due_date_required_if_extended	extended_due_date	error	extended_due_date is required when extension_applied is true — record the revised deadline (maximum two months beyond the original due date)
extended_due_date_format	extended_due_date	error	extended_due_date must be a valid date (YYYY-MM-DD)
status_required	status	error	status is required — track the current state of the DSAR for compliance monitoring
status_valid	status	error	status must be one of: open, in_progress, closed, withdrawn
outcome_required_if_closed	outcome	error	outcome is required when status is closed — record whether the request was fulfilled, refused, partially_fulfilled, or withdrawn
outcome_valid	outcome	error	outcome must be one of: fulfilled, refused, partially_fulfilled, withdrawn
refusal_reason_required_if_refused	refusal_reason	error	refusal_reason is required when outcome is refused — Article 12(4) UK GDPR requires the controller to explain the reasons for not taking action and inform the data subject of their right to complain to the ICO
assigned_to_required	assigned_to	error	assigned_to is required — every DSAR must have a named handler to ensure accountability and prevent requests falling through the cracks
reviewed_by_required	reviewed_by	error	reviewed_by is required — record who reviewed this DSAR record for compliance
review_date_required	review_date	error	review_date is required
review_date_format	review_date	error	review_date must be a valid date (YYYY-MM-DD)

Run your own data against this contract in the free trial — drop a CSV in the dashboard, no code, no credit card. Start free trial →