When Securitas Direct printed a chargeable 902 telephone number on their video surveillance notices, they created what seemed like a minor inconvenience. The Spanish Data Protection Authority saw it differently: a EUR 100,000 violation of Article 12(2) GDPR. Your data subject access request (DSAR) infrastructure might be creating the same liability right now.
This checklist helps you audit whether your DSAR channels truly facilitate rights exercise or quietly discourage it. Each item maps to Article 12(2) GDPR's requirement that controllers "facilitate the exercise" of rights under Articles 15-22. You're not just checking boxes; you're stress-testing whether a motivated data subject can actually use your process without friction, delay, or cost.
Prerequisites
Before you start this audit, gather:
- All customer-facing privacy notices (web, mobile app, physical signage, video surveillance notices)
- Complete inventory of contact channels referenced in those notices (phone numbers, email addresses, web forms, postal addresses)
- Billing records for any telephone numbers you publish (to verify they're toll-free)
- Your DSAR intake procedures and routing workflows
- Training materials for customer service teams who handle data subject inquiries
DSAR Channel Accessibility Checklist
1. Ensure All Contact Methods Are Free to Use
Check: Review billing for all telephone numbers published in privacy notices. Verify email addresses accept inbound mail without sender authentication requirements. Confirm web forms don't require paid accounts.
Article 12(5) GDPR states: "Information provided under Articles 13 and 14 and any communication and actions taken under Articles 15 to 22 and 34 shall be provided free of charge."
What good looks like: A data subject in any EU member state can initiate contact using any published channel without incurring phone charges, postage costs, or platform fees. If you publish a phone number, it's toll-free. If you publish an email, it accepts mail from free providers.
2. Direct Data Subjects to the Most Accessible Channel
Check: Examine your video surveillance signage, cookie notices, and point-of-collection privacy statements. What contact method appears first or most prominently?
The Securitas Direct issue: They directed individuals specifically to a chargeable 902 number in their notices, even though free channels existed elsewhere on their website.
What good looks like: Your most visible notices present your easiest channel: typically a dedicated privacy email address or a simple web form that doesn't require login.
3. Avoid Requiring Authentication Before Submitting a Request
Check: Can someone submit a DSAR without creating an account, logging in, or providing government ID upfront?
The distinction: You can verify identity after receiving a request if you have reasonable doubts (Article 12(6) GDPR). You cannot require authentication to submit the request.
What good looks like: Your web form accepts submissions from anonymous users. Your email address receives mail from any sender. You collect verification information only when responding, not as a gate to intake.
4. Train Customer Service Teams to Recognize DSARs
Check: Send a test access request to your main customer service email and your general inquiry phone line. Does it get routed to your privacy team, or does it languish in a support queue?
Why this matters: A consumer association flagged Securitas Direct's issue. That means data subjects were trying to exercise rights through whatever channel they found. If your support team doesn't recognize "I want to know what data you hold about me" as a DSAR, you're creating the same friction.
What good looks like: Your customer service training includes DSAR recognition and immediate escalation procedures. Every general inquiry channel has a documented handoff to your privacy team.
5. Include Zero-Friction Channels in Physical Notices
Check: Review printed materials (surveillance signage, in-store notices, product packaging). Do they include an email address or toll-free number?
What good looks like: Every physical notice includes your privacy email address prominently. If you include a phone number, it's toll-free from all EU member states where you operate.
6. Allow Mobile App Users to Submit Requests Without App Store Accounts
Check: If you collect data through a mobile app, can users exercise rights without maintaining an active app installation or app store account?
What good looks like: Your privacy notice inside the app includes an email address and web form link that work independently of the app. Users who've deleted your app can still exercise rights.
7. Ensure Web Forms Don't Expire Sessions or Lose Data
Check: Start filling out your DSAR web form, then leave it open for 20 minutes. Does it time out? If you click back after submitting, does it preserve your input?
What good looks like: Your form saves progress locally or provides clear session warnings. It doesn't punish users who need to gather information mid-completion.
Common Mistakes
- Publishing a "privacy contact" that routes to sales: Your privacy email address should deliver to your DPO or privacy team, not to a marketing automation system that tries to convert the inquiry.
- Assuming "we have a free channel somewhere" fixes a paid one: The AEPD rejected this defense. If you direct people to a chargeable number in one notice, the existence of a free option elsewhere doesn't cure the violation.
- Requiring account creation "for security": Article 12(6) lets you request additional information to verify identity. It doesn't let you impose account creation as a prerequisite to request submission.
- Treating DSARs as customer service issues: A request that arrives through your general support channel is still a DSAR with a one-month clock. Route it immediately.
Next Steps
Run this checklist quarterly, not once. Your contact infrastructure changes as you launch products, update websites, and deploy new customer touchpoints. Each new privacy notice is an opportunity to accidentally reference a paid channel or create a new authentication barrier.
After completing this audit, document your findings and remediation timeline. If you discover a paid or high-friction channel in active use, you're facing the same Article 12(2) exposure that cost Securitas Direct EUR 100,000 and a 12-month corrective order.
The real test: Can a data subject who's angry with your company, doesn't have your app installed, and isn't willing to spend money still exercise their rights within five minutes of reading your privacy notice? If the answer is anything other than "yes," you're not facilitating rights exercise. You're hoping people give up.
