● GDPR Art. 12(3) · ONE-MONTH RESPONSE WINDOW

Your GDPR response window is
one month.
DSAR intake keeps it on track.

A customer types "delete my data" in your WhatsApp chat. DSAR intake identifies it, sends an automatic acknowledgement, and files the request so the one-month Art. 12(3) response window never starts silently.

1 month
Art. 12(3) response window (GDPR)
45d
CCPA deadline (+45d extension)
Art. 15 + 17
Access + Erasure covered
Included in Growth+ / Scale — see plans See how it works ↓
The Problem

Data subject requests arrive in WhatsApp, not in a compliance portal.

If they're not logged the moment they arrive, the Art. 12(3) response window starts silently.

💬

"Delete my data" gets buried

Customers send deletion and access requests via WhatsApp chat. Staff read them, don't know what to do, and move on. The one-month Art. 12(3) clock has already started.

⏱

Manual response takes hours

Finding the request, identifying all data held, drafting a response, logging it — hours of work per request. Most small businesses have no process at all.

🚨

Regulators can enforce

Failing to respond to a DSAR within the Art. 12(3) window is a regulatory offence and can lead to enforcement action by the competent supervisory authority (ICO in the UK, CNIL in France, and so on).

How it works

Request in. Signed receipt out. Zero manual work.

DSAR Robot monitors your WhatsApp and Telegram for data subject requests in 5 languages — then handles everything end-to-end.

01

Customer sends request

They type "delete my account", "what data do you have on me", or anything similar — in English, Spanish, French, German, or Portuguese.

02

Robot identifies and processes it

DSAR Robot detects the intent, validates the requester's identity, logs the request with a timestamp, and triggers the correct GDPR or CCPA workflow automatically.

03

Signed receipt delivered

Customer receives a compliant acknowledgement within minutes. You receive a signed audit receipt. Both stored for 7 years as required by law.

What you receive

A compliance receipt that stands up to a regulator

Every request generates a tamper-evident signed record with full audit trail.

✅
DSAR Receipt — Right to Erasure
2026-06-02 14:32 UTC
Request received via WhatsApp Business API

Requester: Maria G. · +44 7700 900123
Request type: Right to Erasure (GDPR Art. 17)
Status: Processed
Acknowledgement sent: 14:32 UTC (0 min)
Data deleted: CRM record, booking history
SIGNED RECEIPT · REF: DSAR-2026-0847
Where you get it

Included in Growth+ and Scale plans

DSAR intake ships as part of the Growth+ ($99/mo) and Scale ($199/mo) BossBot plans — alongside the core CRM + WhatsApp platform. There is no separate standalone SKU.

DSAR INTAKE · INSIDE PLANS
Included in
Growth+ & Scale
No separate purchase — part of the plan you choose
See plans →
Growth+ and Scale customers activate DSAR intake from the dashboard. Cancel plan anytime.
Questions

Frequently asked

Everything you need to know about GDPR data subject request automation.

What is a DSAR? ↓
A Data Subject Access Request (DSAR) is a legal right under GDPR and CCPA that lets any person ask a business: what data do you hold on me, and can you delete it? Under GDPR Article 12(3) the response window is one month from receipt (extendable by two further months for complex requests). Under CCPA the equivalent window is 45 days plus one 45-day extension. Ignoring these requests is a regulatory offence.
What is the deadline for responding to a DSAR? ↓
GDPR Article 12(3) gives one month from receipt of the request. CCPA gives 45 days plus one 45-day extension. Note: the "72 hours" figure sometimes cited for GDPR is Article 33 breach notification (controller to supervisor) — a separate obligation, not the DSAR response window. DSAR intake sends an automatic acknowledgement in seconds and files the request so the Article 12(3) clock does not start silently.
Does DSAR intake work with WhatsApp Business API? ↓
Yes. DSAR intake connects to your WhatsApp Business API number and to Telegram. When a customer types a deletion or access request in natural language — in any of 5 supported languages — the tool identifies it, validates the requester, and files it automatically. No human action required to open the ticket, no request missed.
Get started

Never start the Art. 12(3) clock silently

Every week you wait is another week where a DSAR can arrive on WhatsApp and never make it into a ticket. DSAR intake activates from the dashboard for Growth+ and Scale customers.

See plans →

Back to Security