Templates and records · ISO 27701 · Clause A.1

ISO 27701 data subject request log template

Every time someone asks to see, correct or delete their data, a clock starts ticking. The log proves the request was handled on time and with the right answer.

In one sentence

The data subject request log records every request for access, rectification, erasure, restriction, portability or objection with its date of receipt, the identity check, the action taken and the date of reply, because GDPR article 12(3) allows one month to respond, extendable by two further months, and ISO/IEC 27701 includes handling these requests among the controller controls in table A.1.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause A.1 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Mandatory record A record to be retained as evidence of the control (table A.1; GDPR arts. 12 and 15 to 22)
Who fills it in: Whoever receives the request, and the PIMS manager Customer service or HR log it; the officer reviews borderline cases
When: The same day it arrives The deadline runs from receipt, not from when someone reads it
How long it is kept: Set by the organisation Neither the standard nor the GDPR sets a period for the record itself; the storage limitation principle (GDPR art. 5(1)(e)) means whatever period is chosen has to be justified.

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

The standard asks the controller to have its obligations towards data subjects, and the way it handles their requests, defined and documented: access, correction, erasure, objection and the rest. The processor, for its part, must help its customer respond to them (table A.2 and GDPR art. 28(3)(e)).

The GDPR sets one month from receipt, extendable by two further months where complexity or volume justifies it, provided the data subject is told of the extension within the first month (art. 12(3)). If a request is not acted on, the reasons must be given along with the option of complaining to the authority (art. 12(4)).

Neither the standard nor the Regulation requires a log by this name, but without one there is no way to prove deadlines were met, and the auditor will ask for a sample.

Read it in context: Controls for controllers and processors, in the ISO 27701 Academy

Structure

Fields the template should include

Reference number, date of receipt and channel
Right exercised
Data subject and verification of their identity
Processing activities and systems affected
Deadline and, where applicable, the extension communicated
Action taken, including notifying recipients (GDPR art. 19)
Reply sent and date
Reasoned refusal, if any
Processor involved and its response

Example

Example: an erasure request at a fictitious gym

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Reference and date	DSR-2026-019 · 2 June 2026 · Email to privacy@
Right	Erasure after cancelling membership
Verification	Match with the registered email address and membership number
Systems	Membership software, booking app, newsletter platform
Deadline	2 July 2026
Action	Deleted from bookings and newsletters; in the membership software, billing data are restricted because of tax obligations
Reply	18 June 2026 · Explains what was deleted and what was restricted, with its legal basis · Elmwood Club (fictitious)

At the audit

Mistakes auditors commonly flag

Requests arrive in different mailboxes and nobody tracks the deadline.
Disproportionate proof of identity is demanded for a straightforward right.
Data are deleted from the main system while copies, newsletters and processors are forgotten.
The refusal neither explains the reason nor mentions the right to complain.

In Kimobox

How this record is kept in Kimobox

1Each request is logged in a form with its date of receipt and its calculated deadline.
2The system sends an alert before the deadline and escalates if nobody responds.
3Locating data by data subject points to the systems where action is needed.
4The reply is stored with the request and its evidence.

Frequently asked questions

What people ask us before getting started

What is the deadline for replying?

One month from receipt, extendable by another two where the complexity or number of requests justifies it, as long as the data subject is told within the first month (GDPR art. 12(3)).

Can a fee be charged?

As a rule, no. A reasonable fee, or a refusal, is only possible for manifestly unfounded or excessive requests, and the burden of proving it lies with the controller (GDPR art. 12(5)).

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring