From legal-ops
Data Subject Access Request (DSAR) workflow management. Covers the full 30-day DSAR lifecycle: receipt, identity verification, data discovery, compilation and redaction, response drafting, and logging. Multi-jurisdiction support for UK GDPR, EU GDPR, CCPA, and PIPEDA.
npx claudepluginhub panaversity/agentfactory-business-plugins --plugin legal-opsThis skill uses the workspace's default tool permissions.
| Jurisdiction | Window | Regulator | Extension |
Guides AI agents through GDPR Article 15 DSAR workflow: identity verification, 30-day deadline calculation with extensions, response formatting, exemptions, and fees. For DSAR handling.
Navigates GDPR and CCPA privacy regulations, reviews DPAs, and handles data subject requests. Useful for compliance assessments, vendor agreements, cross-border transfers, and DSAR responses.
Automates GDPR DSAR workflows: identity verification, PII discovery via regex/NER in DBs/files, Article 15 templating, deadline tracking, exemptions, batch processing, audit logging.
Share bugs, ideas, or general feedback.
| Jurisdiction | Window | Regulator | Extension |
|---|---|---|---|
| UK GDPR | 30 cal. days | ICO | +60 days if complex (w/ notice) |
| EU GDPR | 30 cal. days | National DPA | +60 days if complex (w/ notice) |
| CCPA (California) | 45 days | CA AG | +45 days with notice |
| PIPEDA (Canada) | 30 days | OPC | Escalate to Privacy Officer |
| Other | Escalate now | -- | Confirm with Privacy Counsel |
| Request Type | Action |
|---|---|
| Subject Access (Art. 15 / CCPA) | Full data discovery workflow (below) |
| Erasure / Right to be Forgotten (17) | IMMEDIATE escalation to Privacy Counsel |
| Data Portability (Art. 20) | IT lead + Privacy Counsel |
| Rectification (Art. 16) | Relevant system owner + confirmation |
| Restriction of Processing (Art. 18) | Privacy Counsel immediately |
| Objection to Processing (Art. 21) | Privacy Counsel immediately |
| Related ICO/DPA complaint | GC immediately |
ACKNOWLEDGE THE SAME DAY. Acknowledgement MUST include:
Acknowledgement MUST NOT include:
If requester identity is in doubt:
Send discovery requests to ALL relevant system owners:
Discovery deadline: Day 10 Alert: if discovery not complete by Day 15 -> escalate to Privacy Counsel.
REDACT (do not disclose):
DO NOT REDACT:
COMMON ERROR: CRM/sales notes containing opinions about the requester (e.g. "difficult customer", "pushes for discounts") ARE personal data and MUST be disclosed unless a specific exemption applies. Consult Privacy Counsel if in doubt about any redaction decision.
Response letter MUST include:
ROUTE for attorney review on Day 27 at the latest. DO NOT send to requester without attorney sign-off.
Send approved response. Log:
DSAR ACKNOWLEDGEMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Reference: [DSAR-YYYY-MM-DD-XXXX]
Date received: [date]
Requester: [name]
Request type: [Access / Erasure / Portability / Rectification / Other]
Dear [Requester],
We acknowledge receipt of your data subject access request dated [date].
Statutory response deadline: [calculated date -- 30 days UK/EU, 45 days CCPA]
Identity verification: [Required -- please provide X / Confirmed]
Contact for queries: [privacy team email]
We will respond within the statutory timeframe. If we require an extension,
we will notify you with reasons before the deadline.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
INTERNAL DATA DISCOVERY REQUEST
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DSAR Reference: [DSAR-YYYY-MM-DD-XXXX]
Requester: [name / identifier]
Discovery deadline: Day 10 ([date])
Escalation date: Day 15 ([date]) -- if incomplete, escalate to Privacy Counsel
SYSTEMS TO SEARCH:
[ ] CRM / customer database
[ ] Email and communications systems
[ ] Billing and financial systems
[ ] Marketing and analytics platforms
[ ] HR system (if applicable)
[ ] Customer support / ticketing
[ ] Legal case management (privilege review required)
[ ] Legacy / archive systems
Please return all personal data relating to [requester identifier] by [deadline].
Flag any records that may be subject to legal privilege or third-party data.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DSAR RESPONSE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Reference: [DSAR-YYYY-MM-DD-XXXX]
Date received: [date]
Response date: [date]
Jurisdiction: [UK GDPR / EU GDPR / CCPA / Other]
Dear [Requester],
In response to your data subject access request, we confirm the following:
PERSONAL DATA HELD (by category):
- [Category]: [description of data held]
PURPOSES OF PROCESSING:
- [Purpose]: [legal basis]
RECIPIENTS / CATEGORIES OF RECIPIENTS:
- [Recipient category]
RETENTION PERIODS:
- [Category]: [period or criteria]
YOUR RIGHTS:
- Rectification, erasure, restriction, objection, portability
- Right to lodge a complaint with [supervisory authority]
SOURCE OF DATA: [collected directly / obtained from third party]
AUTOMATED DECISION-MAKING: [Yes -- details / None identified]
DATA WITHHELD: [None / Details of data withheld with legal basis]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ALL OUTPUTS REQUIRE REVIEW BY LICENSED ATTORNEY