# DSAR Automation: Assemble Access Requests With an AI Agent on Rails

To automate a DSAR response safely, automate the assembly and keep the decisions human. A [DSAR Assembler](https://privycdp.org/ai/rails/agents/dsar-assembler) agent, at propose level (L2), collects a verified person's records from a customer data platform (CDP) and connected systems, flags gaps and third-party data, and drafts the reply. A privacy analyst verifies identity first, decides every exemption, signs off and sends.

**Who this is for:** DPOs and privacy analysts answering access requests across many systems. This job is one rail in the vendor-neutral [AI agent rails](https://privycdp.org/ai/rails) method. Legal points were checked on 1 November 2026. Take advice on how they apply to you.

## Before: the manual workflow

The manual DSAR workflow is a relay between a privacy analyst and system owners, while a legal clock runs. The analyst logs a request, confirms identity and asks each owner for an export. The analyst then reads everything for other people's data, decides what must be withheld, and writes the reply.

Errors come from three places: a forgotten system, a record belonging to someone else, and a rushed redaction. The European Data Protection Board (EDPB) expects a search of all IT systems and non-IT filing systems, using criteria that mirror how data is structured, and that search extends to processors [1](#source-1).

## How long do you have to answer an access request?

Access request deadlines differ by regime, and the differences change how a rail is built. The table shows the rules we opened. It is not complete: many US states have their own statutes, and sector rules such as HIPAA set their own clocks.

| Regime | Answer within | Extension | Does verification pause the clock? | Rule that shapes the pack |
|---|---|---|---|---|
| GDPR Art. 12(3), Art. 15 [2](#source-2)[3](#source-3) | Without undue delay, and within one month of receipt | Two months for complexity or number of requests; tell the person within the first month, with reasons | The EDPB accepts a suspension while you wait for identity information, if you asked without undue delay [1](#source-1) | Copy of the data plus the Art. 15(1)(a) to (h) information |
| UK GDPR Art. 12A, from 5 February 2026 [4](#source-4) | One month from the latest of receipt, identity information or fee | Two months, with notice inside the first month | Yes, and also while waiting for scope clarification | Search must be reasonable and proportionate [5](#source-5) |
| CCPA Regulations § 7021, § 7024 (effective 1 January 2026) [6](#source-6) | Confirm in 10 business days; answer in 45 calendar days | 45 more days, 90 in total, with notice and reason | No. The period runs from receipt regardless | 12 months by default; older data back to 1 January 2022 on request |
| Virginia, Va. Code § 59.1-577 [7](#source-7) | Without undue delay, within 45 days | Once by 45 days, with notice inside the first 45 | No duty to comply if the request cannot be authenticated | Appeals answered in writing within 60 days |

A deadline service computes these dates, not the model. The EDPB's examples show why. A request received on 31 August is due by 30 September, and a last day on a weekend or public holiday moves to the next working day [1](#source-1). Under the CCPA rule, a timer that waits for verification gets the date wrong.

## After: the job on rails, step by step

The DSAR job on rails separates collection, drafting and decision, and only drafting uses a model.

1. **The request enters through a logged channel.** The deadline service records the receipt date and the regimes that may apply.
2. **A privacy analyst verifies identity.** The agent cannot start until this is recorded, because a verified request is its only trigger.
3. **The scope is frozen.** The EDPB says the assessment should reflect the situation when the request was received [1](#source-1). The analyst decides whether short-lived data needs a hold, so it is not erased mid-request.
4. **Connectors export the records.** A collection service queries each system on the system map using verified identifiers, one subject per run.
5. **The agent drafts.** It writes a pack index by system, gaps, third-party flags, exemptions to consider, plain explanations of codes and a draft reply.
6. **Rules check the draft.** Every mapped system must show a result or a named gap, and excluded fields are removed.
7. **The analyst decides,** records reasons and signs off. Sign-off binds to the pack hash, so a later change voids it.
8. **A separate service delivers the reply,** and the analyst closes the request.
9. **Working copies are deleted.** The ledger keeps metadata only.

The Rule of Two sets the tool scope [8](#source-8). This session reads untrusted text, because emails and notes can carry instructions, and it holds private data. So it gets no state-changing tools: no send, delete or close.

## What rules do and what the model does

Rules, connectors and people do most of this job, and the model drafts words around them.

| Task | Done by | Why |
|---|---|---|
| Compute the deadline | Rules | A date must be exact and explainable |
| Verify identity | Privacy analyst, under a written policy | Impersonation is the main risk |
| Extract the records | Connectors and fixed queries | The copy must be a faithful, intelligible reproduction [9](#source-9). The EDPB allows a compiled form only if nothing is left out or altered [1](#source-1) |
| Remove excluded fields | Rules | California's list is fixed, including Social Security and financial account numbers, though the type collected must be stated [6](#source-6) |
| Spot other people's data | A pattern scan, then model flags | A flag is cheap |
| Explain codes, draft the reply | Model | Raw codes may need explaining [1](#source-1) |
| Decide an exemption | Privacy analyst, with legal advice | See the next section |
| Send and close | Delivery service, then the analyst | Neither is a tool the model holds |

Never let a model paraphrase the personal data itself. A summary can drop a field or change a meaning. Explanations sit beside the export and do not replace it.

## Why can't a model decide an exemption or send the reply?

A model cannot decide an exemption because the law asks a controller to justify the decision in the concrete case.

- **The burden is on you.** The controller must prove a request is manifestly unfounded or excessive [2](#source-2). For Art. 15(4), a general concern is not enough: the EDPB says you must show that rights or freedoms would in fact be affected [1](#source-1).
- **It is a balancing exercise.** The EDPB describes weighing likelihood and severity, then trying to reconcile the interests [1](#source-1). National restrictions under GDPR Art. 23 vary by Member State.
- **A refusal has legal content.** GDPR Art. 12(4) requires reasons and remedies. CCPA § 7024(e) requires a detailed explanation and disclosure of the rest [6](#source-6).
- **Mistakes cannot be recalled.** Unauthorised disclosure falls within the GDPR's definition of a personal data breach [10](#source-10).

The agent's output field is therefore "exemptions to consider", with the rule text attached. The rail has no field where a model records a decision. The [rule against acting without an approval gate](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data) applies without exception.

## Who verifies identity, and how much proof is proportionate?

A privacy analyst owns identity verification, and the proof should match the risk. The EDPB says requiring an identity document is disproportionate where the person is already authenticated, for example by login. It prefers a note such as "ID card was checked" to a stored copy [1](#source-1). For people without an account, California describes two matched data points for categories, and three plus a signed declaration for specific pieces [6](#source-6).

An automated email link is a rule, and privacy tools run such rules well. What stays out of the model's hands is judging a doubtful case from a persuasive message.

## How should third-party data be handled in an access request?

Third-party data is flagged by the agent and resolved by the analyst, usually by redaction and not refusal. The EDPB says Art. 15(4) should not lead to refusing a request altogether, and that it does not apply to the Art. 15(1)(a) to (h) information [1](#source-1). The Court of Justice has held that actual recipients must be named unless that is impossible or the request is manifestly unfounded or excessive (C-154/21), and that Art. 15 generally gives no right to the identity of employees acting under the controller's authority (C-579/21) [9](#source-9). So the system map should hold real recipient names.

The session never queries another person's record. Records can still mention other people, so the pattern scan masks those mentions before the model reads them. The analyst sees the original.

> **Diagram:** Three lanes. Person: verify identity, decide exemptions, sign off, close. Rules and connectors: deadlines, frozen scope, exports, completeness check. Model: pack index, flags, draft reply. A delivery box follows sign-off, with no arrow from the model. A ledger bar runs under all lanes.

## The rail card

The rail card below fixes what the DSAR Assembler may do, and systems enforce it.

| Field | Value |
|---|---|
| Job | Collect data for a verified access request and draft the response pack. |
| Trigger | A request whose requester a person has verified. |
| Data scope | The subject's records within the request scope and the system map. No queries on other subjects; mentions of others masked. |
| Tool scope | Read: system map, in-scope records, response templates. Propose: response pack and draft reply. Execute: none. |
| Output contract | Pack by system, gaps found, third-party data flagged, exemptions to consider, draft reply. |
| Gate | A privacy analyst signs off every pack and decides exemptions. |
| Limits | One subject per run, no outbound tools, working copies kept only for the request. |
| Ledger | Request ID, systems searched, gaps, reviewer, sign-off date. |
| Evaluation | Seeded requests with known records across systems. |
| Owner and kill switch | DPO. An Orchestrator pause returns requests to the manual process, with deadlines unchanged. |

The agent stays at L2. The [rail levels](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder) reserve L4 for reversible actions, and a disclosure of personal data cannot be reversed.

## What the ledger shows for one run

The ledger entry for one run shows what was searched and who signed off, without personal data. This example is illustrative. Reports roll up by rail and role.

```json
{
  "request_id": "dsar_20931",
  "received": "<date>",
  "identity_check": {"method": "account_login", "actor_ref": "usr_118"},
  "systems_searched": ["cdp", "email_platform", "crm", "support_desk"],
  "gaps": [{"system": "call_recordings", "reason": "owner has not answered"}],
  "third_party_flags": 7,
  "exemptions_to_consider": ["art_15_4"],
  "pack_hash": "3ab1...",
  "signed_off": {"actor_ref": "usr_118", "date": "<date>"},
  "model": "model-id@version"
}
```

## Three ways it fails, and the control for each

Each failure below is common in access work, and each control sits outside the model.

| Failure | What it looks like | Control |
|---|---|---|
| A missed system | The pack looks complete, but a new tool or a processor was never searched. | A versioned system map. Each entry must return a result or a named gap. Seeded requests test the rate. |
| Another person's data | A shared name or a bad merge pulls in someone else's records. | Match only on verified identifiers. Flag low-confidence matches. Fix merges through [identity resolution review](https://privycdp.org/ai/rails/use-cases/identity-resolution-review). |
| A confident legal reading | The draft reasons persuasively towards withholding, and a tired analyst agrees. | The agent cites rule text only. The analyst must write the reason. Sign-offs are sampled by role. |

## Metrics that are honest

Honest DSAR metrics measure completeness and timing, not hours saved.

- **Days to complete against the legal deadline,** by regime.
- **Missed-system rate on seeded requests,** which real requests cannot reveal.
- **Extension rate.** The EDPB says frequent extensions may point to weak procedures [1](#source-1).
- **Override rate.** A rate near zero may mean nobody is reading, so sample decisions.
- **Audit coverage.** Any run without a complete record is a defect.

## How vendor tools compare

Dedicated privacy tools cover the workflow around this job, and for many teams they are the better first purchase. We read these pages on 1 November 2026. A page's silence does not prove a feature is missing.

| Tool | What the page we opened says | Human step described | Data location |
|---|---|---|---|
| OneTrust DSR Automation | Automates intake, verification, retrieval, legal hold checks, redaction and portal delivery [11](#source-11). Its 2025 agents are for breach response and risk assessment [12](#source-12). | Not stated on the page | Not stated |
| Transcend DSR Automation | Authentication and preflight checks, including legal holds; redaction on access reports [13](#source-13). | An optional manual step; without one, requests can run in minutes [13](#source-13) | Sombra gateway can be self-hosted, so Transcend holds no keys [14](#source-14) |
| DataGrail Request Manager | Email verification by default; points-based Smart Verification [15](#source-15). | A compliance lead can approve or reject regardless of points [15](#source-15) | A software connector runs in your network [16](#source-16) |
| Ketch | No-code workflows; verification strength by jurisdiction and request type; redaction [17](#source-17). | QA checkpoints where sensitivity calls for review [17](#source-17) | Not stated |

Choose by the gap you have. If you lack a request portal, deadlines and connectors, buy a privacy tool first. If you receive few requests from few systems, fixed queries and a self-service download may be enough, provided self-service does not narrow the scope [1](#source-1). A rail adds most where data is unstructured, where systems sit outside a vendor's connectors, or where personal data cannot leave your environment. This agent runs on a [private model](https://privycdp.org/ai/on-premise-llm-deployment-marketing-personalization) with no external model. PrivyCDP's immutable audit ledger records each AI-assisted action with the actor that authorised it. The DSAR Assembler itself is a method you would build, not a shipped feature.

## Checklist

- [ ] A person verifies identity under a written, proportionate policy.
- [ ] A deadline service computes dates per regime, outside the model.
- [ ] The system map is versioned and includes processors.
- [ ] Records are exported by connectors and queries, never paraphrased by a model.
- [ ] Each mapped system returns a result or a named gap.
- [ ] Sign-off binds to the pack hash, and the signer records reasons.
- [ ] The agent has no send, delete or close tool.
- [ ] Seeded requests run before any model, prompt or tool change.


The wider function is in the [compliance, privacy and security playbook](https://privycdp.org/ai/rails/functions/compliance-privacy-security), and the method is on the [AI agent rails hub](https://privycdp.org/ai/rails). To write this rail for your team, download the [rail card template](https://privycdp.org/tools/agent-rail-card).

Rail level: L2 · Risk: high · Function: compliance privacy security

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### How do you automate a DSAR response?

Automate the collection and the first draft, and keep the decisions with people. Connectors export records from mapped systems. An agent indexes them, flags gaps and third-party data, and drafts the reply. A privacy analyst verifies identity beforehand, decides exemptions, signs off and sends.

### What is the deadline for a DSAR under GDPR and the CCPA?

GDPR Art. 12(3) sets one month from receipt, extendable by two months with reasons given in the first month. California's regulations require confirmation within 10 business days and an answer within 45 calendar days, extendable to 90 with notice. The California clock runs from receipt, regardless of verification time.

### Can AI verify the identity of the person making a request?

Keep this with a person and written rules. Automated checks such as an email link or an existing login are rules, and they are often proportionate. A model should not judge a doubtful case, because it reads the requester's own text and can be persuaded by it. Impersonation is the risk that matters most here.

### Can an AI agent decide a DSAR exemption?

No. The controller must be able to show why an exemption applies in the concrete case, and the EDPB describes a balancing of likelihood and severity. An agent can list exemptions to consider and attach the rule text. A privacy analyst decides and records the reason, with legal advice where the case needs it.

### Do we need an AI agent if we already use a privacy tool?

Often not. OneTrust, Transcend, DataGrail and Ketch all describe workflow, verification and redaction. An agent helps with unstructured records, systems outside the vendor's connectors, and drafting. Run a seeded request through your current tool first and measure what it misses.

## Sources

1. EDPB, Guidelines 01/2022 on the right of access, version 2.1: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en
2. GDPR Article 12: https://gdpr-info.eu/art-12-gdpr/
3. GDPR Article 15: https://gdpr-info.eu/art-15-gdpr/
4. Data (Use and Access) Act 2025, section 76: https://www.legislation.gov.uk/ukpga/2025/18/section/76
5. Same Act, section 78: https://www.legislation.gov.uk/ukpga/2025/18/section/78
6. California Privacy Protection Agency, CCPA Regulations, effective 1 January 2026: https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf
7. Code of Virginia § 59.1-577: https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577/
8. Meta, Agents Rule of Two (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
9. CJEU, C-154/21 and C-579/21, judgments of 12 January 2023 and 22 June 2023:  and: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62021CJ0154 ; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62021CJ0579
10. GDPR Article 4: https://gdpr-info.eu/art-4-gdpr/
11. OneTrust, DSR Automation: https://www.onetrust.com/products/privacy-rights-automation/
12. OneTrust, release of 23 April 2025: https://www.onetrust.com/news/onetrust-unveils-the-future-of-privacy-in-the-age-of-ai/
13. Transcend, DSR Automation: https://docs.transcend.io/docs/dsr-automation/overview
14. Transcend, Sombra: https://docs.transcend.io/docs/articles/sombra/introduction
15. DataGrail, verification: https://docs.datagrail.io/docs/request-manager/request-intake/verification
16. DataGrail, Request Manager Agent: https://docs.datagrail.io/docs/integrations/internal-systems-integrations/request-manager-agent/overview
17. Ketch, DSR automation: https://www.ketch.com/features/data-subject-rights

This article is general information, not legal advice.

## Further reading

- [DSAR Assembler: An AI Agent That Prepares Access Request Packs](https://privycdp.org/ai/rails/agents/dsar-assembler)
- [AI Agents for Compliance, Privacy and Security Teams: The Playbook on Rails](https://privycdp.org/ai/rails/functions/compliance-privacy-security)
- [Access Review Assistant: An AI Agent for Least-Privilege Reviews](https://privycdp.org/ai/rails/agents/access-review-assistant)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)