How to use the DSAR Response Drafter agent skill

What the dsar-response skill makes the agent do

When someone asks a company for a copy of their data, or to delete, port or correct it, the skill takes the agent through the process one step at a time. It classifies the request type, checks escalation triggers, verifies identity, looks up each system that holds the person's data, considers legal exemptions, and drafts the letters.

The agent is told not to send anything itself. It produces a draft for a human to review and send, and it logs the request according to your house process.

• Classifies the request as access, deletion or erasure, portability, correction or rectification, objection, restriction, or opt-out of sale/share or automated decision-making
• Walks the systems list from your configuration and records what was queried and what data was found
• Assesses exemptions and flags uncertain legal points for attorney verification
• Drafts an acknowledgment letter and a substantive response letter

What you need before you install the skill

The skill is built for a privacy or legal team that already has a documented process. It assumes a configured company process and legal review, and it is not legal advice. Check these requirements first.

• Claude Code or a compatible agent, with the claude-for-legal privacy-legal plugin configured
• A practice-level CLAUDE.md at ~/.claude/plugins/config/claude-for-legal/privacy-legal/ that contains a DSAR process section with a systems list, a verification method and a response SLA
• Optional: a configured legal research tool, such as Westlaw, for citation lookups
• Network access, which the skill uses

Install the dsar-response skill

Download the skill ZIP from the agent-skills directory page. The package contains one file, SKILL.md. You can install it in either of two ways for Claude Code, or upload it in the Claude apps.

For a personal install, unzip the package into ~/.claude/skills/. To limit it to one project, unzip it into the .claude/skills/ folder inside that project. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload the ZIP there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Set up your DSAR process in CLAUDE.md

The skill reads your practice settings before it does anything. It loads the DSAR process section of the practice-level CLAUDE.md, which holds the systems list, the identity verification method and the response SLA. It also notes who handles routine requests and who gets escalated.

If the systems list is empty or out of date, the skill flags it. A complete DSAR needs a complete list of where personal data lives, so keep this section current before you start using the skill.

• Systems list: every place user data lives, including production databases, analytics, support tickets, CRM, email marketing, logs, backups and third-party processors
• Verification method: how you confirm identity for each risk level
• SLA: your response deadline under the applicable regime
• Escalation: who handles routine requests and who receives escalations

Trigger the skill with a natural request or the slash command

You can start the skill in two ways. Use the slash command and paste the request, or describe the request in plain language. The skill's description lists phrases that activate it, such as 'DSAR came in', 'access request', 'right to be forgotten' and 'someone wants their data'.

If you use a matter workspace, the skill asks which matter the request belongs to before it writes any output. If you are working at practice level, say so.

• Plain request: 'A DSAR came in, here is the email. Walk me through it.'
• Plain request: 'Someone wants their data. Help me draft the response.'
• Plain request: 'This person asks us to delete their account and send their data first.' The skill handles this as a deletion and a portability request linked together.
• Slash command with pasted request: /privacy-legal:dsar-response followed by the request text
• Matter switch when matter workspaces are enabled: /privacy-legal:matter-workspace switch <slug>, or say practice-level

Work through a request from start to finish

The skill follows the same order for every request. It classifies the right being invoked and researches the rule that applies. Then it verifies identity, walks the systems list and assesses exemptions before drafting.

Identity verification is calibrated to risk. Over-verifying creates a barrier that regulators may criticise, and under-verifying can hand someone else's data to a fraudster. If identity cannot be verified, the skill drafts a holding letter asking for the verification step and does not provide personal data. Do not wait until the deadline to send it.

The research step tags every citation with its source and a verification tier. Tool-retrieved citations keep their source tag. Web-search results are tagged as web search and should be checked against a primary source before you rely on them.

• Classify the request and identify the applicable regime (GDPR, UK GDPR, CCPA/CPRA, other US state laws or sectoral rules)
• Verify identity using the method in your CLAUDE.md
• Walk each system in the list and record whether it was queried and what was found
• Analyse exemptions, with backups usually exempt from deletion and third-party processors possibly needing notification
• Draft the letters and log the request per your house process
• If a research query returns thin results, the skill reports what it found and asks you how to proceed rather than filling the gap silently

Safety notes: personal data, scripts and network use

A DSAR contains the data subject's personal information. Confirm that your session and output storage meet your data-handling requirements before you paste anything. Redact what you don't need, such as ID attachments and unrelated email threads, and do not put the subject's name in filenames.

The skill does not run scripts. It does use the network, for example when it queries a configured legal research tool. Because it drafts only, a human must review every letter, check the legal statements in it and send it.

• Redact ID attachments and unrelated email threads before pasting
• Do not store the subject's name in filenames
• Runs scripts: no
• Uses network: yes
• Drafts are not sent automatically