An automated subject request pipeline has six stages: intake, identity check, fan out to each system holding data, human review, packaging and secure delivery, with a clock and audit trail throughout. Automate the collecting, keep a person on the decision, and build around the one month deadline in GDPR Article 12.
For the legal steps, see how to answer a GDPR data subject access request. This post covers the engineering.
Stage 1: intake
Offer a form and an email address, and route both into one ticket with a request ID and a received date. Article 12(3) starts the one month clock from receipt, so record the timestamp and compute the due date. If the request is complex or numerous, the extension of up to two months must be communicated, with reasons, within the first month. Build a reminder for that decision at about the halfway point.
Stage 2: identity
Verify before disclosing. Article 12(6) lets you ask for extra information when you have reasonable doubt about who is asking. Prefer confirming through a logged in session or a message to the address on file over collecting new documents. See verifying requester identity.
Stage 3: fan out
Each system that holds personal data exposes a small connector with two functions: find records for a subject and export them. Keep a registry of connectors, driven by your data map, so a new system cannot go live without one.
Run connectors in parallel, with timeouts and retries. Write each result to a staging area keyed by request ID with a status per system: pending, done, empty or failed. A failed connector must block completion and page someone, otherwise you send an incomplete answer.
Include vendors. For systems you do not control, the connector may be an API call or a documented support request.
Stage 4: review
A person checks the package before it leaves. They look for third party personal data that must be redacted, privileged material and anything exempt. Show reviewers a diff-like view per system, and record their decisions.
Stage 5: package and deliver
Produce a readable summary plus machine readable files such as JSON or CSV. Include the information Article 15 requires alongside the data, such as purposes and recipients. Deliver through an expiring download link behind authentication, not as an email attachment. Expire the staging data on a short timer, since the export is itself a copy of personal data.
Stage 6: audit trail
Log who handled the request, which systems were queried, what was redacted and when it was delivered. Keep this for as long as you need to show compliance, and keep the log free of the exported content.
Metrics worth watching
- Days to complete, against the one month limit.
- Connector failure rate.
- Requests needing extension.
- Share of requests where identity checks caused delay.
Quick check
Can the whole thing be fully automatic?
Collection can be. Keep a human review step for redaction and exemptions, since an error discloses someone else's data.
Where should exported files be stored?
In an access controlled area with a short expiry, because the package is a new copy of personal data.
Sources
Last reviewed: 19 October 2026.
