Free resource
A defensible record of subject requests plus a retention schedule - the audit trail a regulator and an ISO auditor both want when you handle sensitive personal data.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Read this tab first, then work through the checklist. Score honestly - a 'Partly' you can see is worth more than a 'Yes' you cannot evidence. This is a working tool, not a certificate: it shows where an assessor will push, before they do.
| Topic | Detail |
|---|---|
| What this is | Two working records auditors and regulators both ask for: a defensible log of subject access requests, and a retention schedule. For credit and collections, the audit trail - what was found, disclosed, redacted and when - is the point. |
| How to use it | Log every DSAR as it arrives, not afterwards. Fill the retention schedule against your own regulatory obligations - the periods shown are illustrative and marked 'verify'. |
| The #1 mistake | Treating a DSAR as an IT export. It is a legal process with an identity check, a one-month clock, third-party redaction and narrow exemptions - the 'Handling notes' tab covers each. |
| A second pair of eyes | If you want someone who has sat on the other side of the audit table to sanity-check your scoring before it counts, that is what we do at kellwick.com. |
Sheet: DSAR Log
A defensible record of subject requests. Under FCA and ICO scrutiny, the audit trail is the point: what was found, what was disclosed or redacted, and when. Rows 1-2 are worked examples - delete them and log your own. The statutory response time is one month from receipt.
| Request date | Data subject (ref) | Received via | Due date (1 month) | Data located | Disclosed / redacted | Completed date | Handler |
|---|---|---|---|---|---|---|---|
| 2026-06-01 (example) | DS-0001 | 2026-07-01 | CRM record, call recordings, collection case notes | Disclosed; third-party names and card PAN redacted | 2026-06-24 | [handler] | |
| 2026-06-10 (example) | DS-0002 | Web form | 2026-07-10 | Support tickets, account and affordability data | Partly refused - manifestly excessive repeat request; scope explained in the response | 2026-06-30 | [handler] |
Sheet: Retention Schedule
Retention has to be evidenced, not assumed. For each category, record the legal basis, the period, and how destruction is done and recorded. The periods below are ILLUSTRATIVE common practice - verify each against your own regulatory obligations and policy before relying on it.
| Data category | Legal basis | Retention period (illustrative - verify) | Destruction method | Owner |
|---|---|---|---|---|
| Call recordings | Legitimate interest / regulatory | e.g. 6 years (verify) | - | - |
| Affordability data | Contract / legitimate interest | e.g. 6 years after the case closes (verify) | - | - |
| KYC / identity documents | Legal obligation (MLR 2017) | 5 years after the relationship ends (MLR 2017) | - | - |
| Collection case notes | Legitimate interest | e.g. 6 years (verify) | - | - |
Sheet: Handling notes
The parts of a DSAR that most often go wrong. Get these right and the log above becomes a genuine defence rather than a liability.
| Topic | What to get right |
|---|---|
| Verify identity first | Confirm the requester is the data subject before disclosing anything. Over-disclosing to an imposter is itself a personal-data breach. |
| The clock is one month | From receipt, not from when you get to it. You may extend by up to two further months for complex requests, but you must tell the subject within the first month and say why. |
| Third-party data | Redact other people's personal data unless they consent or it is reasonable to disclose without it. Record what you redacted and why. |
| Exemptions are narrow | You can refuse or charge only in defined cases (for example manifestly unfounded or excessive requests). Document the reason - 'it was a hassle' is not a lawful basis. |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources