Dsar software
- Disclosures the policy owes
- 15
- Category-by-purpose statements to be able to defend
- 35
- Recipients a reader can ask you to name
- 11
The response deadlines come from the statutes themselves: California Civil Code § 1798.130(a)(2) and Regulation (EU) 2016/679, Article 12(3), both read on 2026-09-06. Everything else in the builders is your own count and the arithmetic shown beside each figure.
DSAR software is not a mailbox with a label on it. What it has to do is hold four things against one request: the date it arrived, the systems you searched, what you released or refused, and who approved the answer: because those four are what somebody asks for months later when the request has become a complaint. Dsarvo Pro keeps them for $10 a month, and the clock is counted from receipt because that is what the statutes count from.
Open the Data privacy policy Free to use. No account, no card, no sign-up.
Log it the day it arrives
The receipt date is the one figure you cannot reconstruct later, and every deadline runs from it. Logging the request starts the clock at the right moment rather than the convenient one.
Acknowledge inside ten business days, and say what happens next
California requires the business to confirm receipt within ten business days and say how the request will be processed; the GDPR expects the person to be kept informed. The acknowledgement is a short message: received on this date, this is what will happen, this is when you will hear. It is also the second entry in the record after the receipt date, because the gap between the two is the first thing a regulator measures.
Record what you searched
A list of the systems you looked in, each with the date and the person. This is the part that turns an answer into something you can stand behind, and the part an inbox thread never has.
Answer, and keep what went out
What was released, what was withheld and on what basis, who approved it and the date it was sent. The record holds the answer beside the deadline it was measured against.
Close the request from the record, not from the inbox
A request is closed when its row holds the receipt date, the acknowledgement, the identification, the scope, the systems searched with a name and a date against each, what went out, what was withheld and why, who approved it, and the date it was sent measured against the deadline it ran on. An inbox thread holds a conversation; the row holds the evidence. Dsarvo Pro is the row, kept for as long as the request could become a complaint, and the export is yours.
Subject access requests: what people ask
How long do I actually have?
California Civil Code § 1798.130(a)(2) requires a business to disclose and deliver the information, correct inaccurate personal information, or delete personal information within 45 days of receipt of the consumer's request, extendable once by an additional 45 days when reasonably necessary provided the consumer is given notice within the first 45-day period. Article 12(3) of the GDPR requires action without undue delay and in any event within one month of receipt, extendable by two further months where necessary. Both run from receipt.
Does the free builder cover this?
No. The four builders size the documents you publish: the privacy policy, the cookie policy, the vendor agreements and the review checklist. They are free and need no account. The request record is the paid part, because keeping something for years is the part that costs us money.
What happens to my records if I stop paying?
They stay readable and exportable. Canceling ends the billing, not your access to what you already recorded: a record you cannot get back is not a record.
Which requests count toward the clock?
Every request to know, delete, correct, port or opt out, however it is phrased and wherever it arrives: a support ticket, a reply to a newsletter, a phone call, a form. The clock runs from receipt whether or not anyone recognized it, which is why intake is one person's job and every inbox is on their list.
A request the Dsar software does not fit?
Two things the builders do not cover: a request that arrives from somebody you cannot identify, and a regime we have not modelled. Tell us the situation and one person reads it.