For privacy ops, compliance, and DPO teams
Export Gmail for a GDPR DSAR
A Data Subject Access Request (DSAR) under GDPR — or its analogue under UK GDPR, CCPA, LGPD, or other regimes — generally requires producing the personal data your organization holds about an individual. For most companies, a meaningful share of that data lives in employee Gmail: customer-support threads, sales correspondence, escalation emails, anything that mentions the data subject by name or contact details.
ThreadPDF is the tool for the email side of that production. It's a Chrome extension that searches Gmail using the operators you already know, lets you select the responsive threads, and exports them as PDFs with their original attachments. Everything runs in the browser, which matters when you're handling personal data of a subject who has, by definition, formally asked you to account for it.
How to export responsive Gmail threads for a DSAR with ThreadPDF
- 1
Identify the inboxes in scope
Common scope for a customer DSAR: the support team's shared inbox, the AE who owned the account, the customer-success manager, and any escalation thread to engineering or legal. Each inbox is a separate export.
- 2
Build search queries from the subject's identifiers
Start with the obvious: the subject's email address (from:subject@example.com OR to:subject@example.com), their full name in quotes ("Jane Doe"), their customer ID if you have one, and any unique identifiers (phone number, account number). Run each query separately and document what you ran.
- 3
Review and select responsive threads
DSARs require producing personal data about the subject, not every email that ever mentioned them in passing. Review the search results and check the threads that are actually responsive — ThreadPDF only exports what you've selected.
- 4
Export to PDF with attachments
Pick PDF as the format and enable attachments. The full thread (with headers, body, and reply chain) renders to one PDF per thread; attachments — screenshots, signed agreements, support transcripts — ship in a ZIP.
- 5
Pass to legal for review and redaction
DSAR responses typically require redacting third-party personal data and applying any applicable exceptions. ThreadPDF stops at the export — redaction and the final response packet is a legal task, not a tool one.
What this looks like in practice
A privacy ops team responding to a DSAR from a customer might produce this internal review packet before redaction.
Per-inbox, per-query exports:
dsar-2026-0412-jane-doe/
01-support-inbox/
query-a_email-from-to/
threads/ (search: from:jane.doe@example.com OR to:jane.doe@example.com)
attachments.zip
query-b_name-quoted/
threads/ (search: "Jane Doe")
attachments.zip
02-sales-inbox-ae-alex/
query-a_email/
threads/
attachments.zip
03-cs-inbox-mgr-priya/
query-a_email/
threads/
attachments.zip
QUERIES_RUN.txt
Per-inbox: which Gmail queries were executed, on what date,
thread counts returned, thread counts selected as responsive.
NOTES_FOR_LEGAL.txt
Subject identifiers used, scope decisions, anything legal needs
to know before redacting and assembling the final response.- The query log matters as much as the PDFs themselves — it's what makes the response defensible if the subject's representative pushes back on completeness.
- ThreadPDF does not redact. Redaction is a downstream legal step, typically done in Acrobat or a dedicated redaction tool.
Why ThreadPDF for DSAR responses specifically
On-device processing for personal data of a known subject
A DSAR is, by definition, about a person who has formally exercised their data rights. Routing their personal data through a third-party server-side conversion tool adds a processor where you don't need one. ThreadPDF processes everything in the browser of the person running the export.
Reproducible, query-based workflow
Each export starts from a Gmail search query you can write down. That makes the production reproducible and the scope auditable — both of which matter when the subject (or a regulator) asks how the search was conducted.
Attachments preserved in native format
DSARs often pull in screenshots, signed forms, and support attachments. ThreadPDF keeps them in their original format inside the attachment ZIP, so review counsel can hash, re-render, or redact them as needed.
Get the email side of the DSAR into a folder
Install ThreadPDF on the inbox-owners' Chrome, run the queries, and hand a clean folder to legal. Pro is $4.99/month per user.
Install ThreadPDF