One month to answer: a GDPR Article 12 deadline tracker for customer data requests that come in through AI chatbots and tools
What you get: a finished request deadline tracker in three tabs: a request log with one row per request and a reply-by date formula that handles short months and weekends, an extension and refusal tab with the reasons you must give, and a holidays tab for your country, plus AI tool examples and two made-up example rows.
Short answer: under Article 12(3) GDPR you must tell the person what you did about an access, correction, erasure, restriction, portability or objection request without undue delay and within one month of receiving it. You can add two further months only where needed because of the complexity and number of requests, and you must tell the person about the extension, with reasons, inside the first month. If you will not act, Article 12(4) says you must explain why, and mention the right to complain and go to court, also within one month. Replies are free of charge unless a request is manifestly unfounded or excessive (Article 12(5)).
Why AI tools make this harder
Requests now arrive through chatbots, AI email assistants and support widgets, and the data sits in several AI suppliers at once: chat transcripts, call recordings, meeting notes, lead lists. A request that lands in a chatbot transcript on a Friday can be missed for days. Article 12(2) says you must make it easy to use these rights, so a request counts from the day it reaches you, whichever channel it came through.
Step 1: tab 1, request log (one row per request)
| Column | What to write | Source |
|---|---|---|
| A. Who and what | Requester reference (not their full details) and the right used: access (Art. 15), correction (16), erasure (17), restriction (18), portability (20), objection (21) | Art. 12(2) |
| B. Received on | The date it reached you, in any channel: email, chatbot, phone, form, social message | Art. 12(3) |
| C. Came in through | "website chatbot", "AI email assistant", "support widget". Reply electronically if it came electronically, unless the person asked otherwise | Art. 12(3) |
| D. AI tools holding their data | Every tool to search: chatbot logs, note-taker, CRM enrichment, call recorder. Copy from your AI register | Art. 15 to 21 |
| E. One-month date | =EDATE(B2,1). EDATE moves 31 August to 30 September, which matches the EDPB example for months with no matching day | EDPB Guidelines 01/2022, examples 32 and 33 |
| F. Reply by | =WORKDAY(E2-1,1,Holidays!A:A). If the one-month date falls on a weekend or public holiday, this rolls to the next working day | EDPB Guidelines 01/2022, para. 161 |
| G. Identity check sent? | Only if you have reasonable doubts about who is asking: ask for the minimum extra information needed. Log the date | Art. 12(6) |
| H. Days left | =IF(I2<>"",0,F2-TODAY()) | our working rule |
| I. Answered on | Date the reply went out | Art. 12(3) |
| J. Status | =IF(I2<>"",IF(I2<=IF(Tab2!C2="Yes",Tab2!E2,F2),"Answered on time","Answered late: note why"),IF(H2<0,"Overdue","Open: "&H2&" days left"&IF(H2<=7,", reply this week",""))) | our working rule |
The 7-day flag is our own working rule to catch requests early. The law says "without undue delay", so one month is the outer limit, not a target.
Step 2: tab 2, extension or refusal (same row number as tab 1)
| Column | What to write | Source |
|---|---|---|
| A. Request ref | Same reference as tab 1 | |
| B. Why it is complex | Only real reasons, such as data spread across several AI suppliers, transcripts that need other people's details removed, or a sudden spike in requests. A large effort alone is not enough | Art. 12(3); EDPB Guidelines 01/2022, paras. 163 and 164 |
| C. Extending? | Yes or No | Art. 12(3) |
| D. Extension notice sent on | Must be inside the first month, with the reasons | Art. 12(3) |
| E. Extended reply by | =IF(C2="Yes",WORKDAY(EDATE(Tab1!B2,3)-1,1,Holidays!A:A),"") | Art. 12(3); our working rule for the date count |
| F. Notice in time? | =IF(C2<>"Yes","",IF(D2="","Send the extension notice by "&TEXT(Tab1!F2,"d mmm yyyy"),IF(D2<=Tab1!F2,"Notice in time","Notice late"))) | Art. 12(3) |
| G. Not acting? Reason | Why you will not act, for example manifestly unfounded or excessive (you must be able to show this), or you cannot identify the person | Art. 12(2), 12(4), 12(5) |
| H. Refusal letter includes | The reason, the right to complain to a data protection authority and the right to go to court. Send within one month | Art. 12(4) |
| I. Fee charged? | Normally No. A reasonable fee based on admin costs only for a manifestly unfounded or excessive request, such as repeated identical requests | Art. 12(5) |
Step 3: tab 3, holidays
List your country's public holidays for 2026 and 2027 in column A, one date per row, and name the range Holidays. The reply-by formulas skip these days and weekends. If you handle requests for several EU countries, keep one column per country and point each row at the right one.
Two made-up example rows
| Request | Received | One-month date | Reply by | What happened |
|---|---|---|---|---|
| Access request typed into a salon's booking chatbot | 31 Aug 2026 | 30 Sep 2026 | 30 Sep 2026 (Wednesday) | Transcripts and booking notes exported from two tools, sent on 14 Sep: answered on time |
| Erasure request emailed to an agency, data in a note-taker, CRM and call recorder | 28 Nov 2026 | 28 Dec 2026 | 29 Dec 2026 if 28 Dec is a holiday in the holidays tab | Extension notice with reasons sent on 10 Dec; extended date 28 Feb 2027 is a Sunday, so the reply is due by Monday 1 Mar 2027 |
These rows are made up for illustration and do not describe any real business.
Checks before you send a reply
- Did you search every AI tool listed in column D, including supplier-held logs?
- Is the reply in clear and plain language (Article 12(1))?
- Did you tell every recipient about a correction, erasure or restriction? See the Article 19 recipient notices sheet
- For access requests, use the Article 15 access request sheet; for erasure or objection, the Article 17 and 21 sheet
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Article 12 and Recital 59, as published on gdpr-info.eu) and the EDPB Guidelines 01/2022 on the right of access, version 2.0. The EDPB examples are written for access requests; we apply the same date count to the other rights as our working rule. The status formulas and the 7-day flag are our own working rules. Authorities may take a stricter view, so check your data protection authority's guidance. Example rows are made up for illustration and do not describe any real business. Checked on 27 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients who run chatbots and AI email assistants get requests they do not notice. Hand them tab 1 with the client AI inventory, stay inside your professional rules and refer legal questions on.
Know which AI tools hold each person's data
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Use its list of AI tools to fill column D, and attach this tracker as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this tracker. Related: Article 16 correction requests · Article 18 restriction requests · Article 20 portability requests · retention schedule for chat logs
Sources
- Article 12 GDPR, Transparent information, communication and modalities (with Recital 59); official text: Regulation (EU) 2016/679
- EDPB Guidelines 01/2022 on data subject rights, right of access, version 2.0 (paras. 159 to 164, examples 32 and 33)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.