GDPR Request Evidence & Deadline Tracker
The request, the date sent, the deadline, the extension notice, the response — in one structured log that turns a missed GDPR deadline into an open-and-shut DPA complaint.
GDPR rights are strong — but they run on a deadline you have to prove
A Subject Access Request, an erasure request, a rectification — GDPR gives you real, enforceable rights, and a free complaint path to your national Data Protection Authority when a company ignores them. But every one of those routes turns on the same thing: proof of what you asked for, when you asked, and whether the company answered inside the legal deadline.
The deadline is one month from the request — extendable by up to two further months for genuinely complex requests, but only if the company notifies you of the extension, with reasons, inside that first month. Miss the evidence for that clock, or lose track of whether a valid extension notice ever arrived, and a clear-cut complaint turns into a "your word against theirs" dispute.
Step by step
- Download the PDF tracker and the Excel version the moment you send a GDPR request.
- Log the request type (access, erasure, or rectification), the date sent, and the company or DPO you contacted.
- Record the applicable deadline — one month by default — and note whether an extension notice arrived within that first month (extending it to three months total).
- Record whether a response was received, with its date, so you can see at a glance if the deadline was actually missed.
- If unresolved, record the next escalation step — a follow-up, a DPO complaint, or a filing with your national DPA.
Anyone exercising a GDPR right in the EU/EEA
Access, erasure, or rectification — a single dated record of the request, the deadline, and the response is what turns a statutory right into an enforceable DPA complaint.
- Print-ready PDF request tracker
- Editable Excel version
- Request-type field (access / erasure / rectification)
- Date-sent and company/DPO-contacted fields
- Deadline tracker — one month, extendable to three for complex requests
- Extension-notice-received flag (with the in-first-month validity test)
- Response-received field (Y/N + date)
- Next-escalation-step field
- Works on any device
A strong GDPR right is worth nothing without the dated proof to enforce it.
Build the record a Data Protection Authority can't wave away — the request, the deadline, the extension notice, and the response — before your complaint window slips.
Get it — $5.90 →One-time $5.90 · PDF + Excel · Works on any device