Data Subject Access Request (DSAR) Procedure

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: [DPO / Privacy Lead]

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Define how Touch2Sign receives, verifies, and responds to requests from individuals exercising rights under GDPR Articles 15–22 and UK GDPR. Ensures responses within statutory timeframes and clarifies Touch2Sign's role as controller vs processor.

2. Scope

Applies to requests from:

• Signers and witnesses whose personal data Touch2Sign processes
• Customer organisation users (admins, senders)
• Former employees (handled under HR policy — separate process)

Covers rights of access, rectification, erasure, restriction, portability, and objection.

3. Contact channel

Channel	Detail
Primary email	privacy@touch2sign.com
Postal	[Touch2Sign Ltd registered address]
Web form	Link from Privacy Policy (when published)

All DSARs logged in DSAR Register within 2 business days of receipt.

4. Controller vs processor

Scenario	Touch2Sign role	Who responds
Signer data processed on behalf of customer (documents, audit trail)	Processor	Forward to customer controller; assist per DPA §6
Touch2Sign account billing, marketing, website analytics	Controller	Touch2Sign responds directly
Employee data	Controller	HR + DPO

When Touch2Sign is processor, the customer organisation is controller and primary respondent. Touch2Sign assists within 30 days and DPA terms.

5. SLA and extensions

Milestone	Target
Acknowledgement of receipt	5 business days
Identity verification complete	10 business days
Full response	30 calendar days from receipt
Extension (complex requests)	+ 60 days with reason notified to data subject
Processor assistance to customer	30 calendar days from customer request

6. Request handling process

Step 1 — Intake and logging

Record in DSAR Register:

Field	Description
DSAR ID	DSAR-YYYY-NNN
Date received
Requester name and contact
Rights exercised	Access / erasure / etc.
Touch2Sign role	Controller / processor
Customer org (if applicable)
Status	Open / verifying / in progress / closed

Step 2 — Identity verification

Before disclosing personal data:

• Match requester to records (email verification, signing history, org admin confirmation)
• Request additional ID only if necessary and proportionate
• Do not disclose data to unverified third parties
• For processor requests: confirm requester with customer controller where appropriate

Step 3 — Scope and search

Search relevant systems:

System	Data
RDS	users, recipients, audit_log, org membership
S3	Signed PDFs linked to requester (if access request)
Cognito	Account attributes
Support tickets	Tickets referencing requester
Stripe	Billing metadata (controller requests only)
Sub-processors	Query OneID / eID Easy if IDV data requested — via DPA

Document search scope and any data not found.

Step 4 — Legal review

DPO reviews for exemptions (Art 15(4), manifestly unfounded/excessive requests Art 12(5)), conflicts with other data subjects' rights, and erasure limitations (signature evidence retention).

Step 5 — Response

Provide response in structured, commonly used, machine-readable format where portability requested (JSON or CSV + PDF copies of documents).

Access response includes:

• Confirmation of processing
• Categories of data and purposes
• Recipients or categories (sub-processors summary)
• Retention period
• Rights and complaint authority (DPC / ICO)
• Copy of personal data

Step 6 — Closure

Update DSAR Register; retain record 3 years.

7. Right-specific guidance

Right	Touch2Sign action
Access (Art 15)	Export personal data; explain processing
Rectification (Art 16)	Correct inaccurate account data; notify customer controller for document content
Erasure (Art 17)	Per Data Retention Policy; may refuse where signature evidence required
Restriction (Art 18)	Flag account pending dispute resolution
Portability (Art 20)	Provide machine-readable export where processing automated + consent/contract
Objection (Art 21)	Assess; stop marketing; document legitimate interest balancing

8. Refusal and partial response

If request refused or partially fulfilled:

• Explain reasons within 30 days
• Inform data subject of right to complain to DPC (Ireland) or ICO (UK)
• Document rationale in DSAR Register

Manifestly unfounded or excessive requests: charge reasonable fee or refuse per Art 12(5) — DPO + Legal approval required.

9. Customer (controller) coordination

When request concerns signer data for a customer organisation:

1. Notify customer within 5 business days
2. Provide tools or exports to assist (DPA §6)
3. Do not release customer's confidential document content to wrong party
4. Customer leads communication with data subject unless agreed otherwise

Template available to customers in DPA annex.

10. Fees

First request free. Repeated or manifestly unfounded requests may incur reasonable administrative fee per GDPR Art 12(5).

11. Related documents

• Privacy Policy
• Data Processing Agreement
• Data Retention & Disposal Policy
• Breach Notification Procedure
• SUB_PROCESSORS.md

12. Review

Reviewed annually and after significant DSAR volume or regulatory guidance changes.

---

Approval

Name	Role	Signature	Date
Robert	CEO	Electronic	11 July 2026
	DPO / Privacy Lead