A DSAR, or data subject access request, is a request in which an individual asks an organization to confirm whether it processes their personal data, to provide a copy of that data and to explain how it is used. In privacy law, the DSAR is the practical vehicle for the right of access, one of the core user rights under the GDPR, the UK GDPR and comparable laws such as the California Consumer Privacy Act.
Although the term formally refers to access, organizations often use DSAR as an umbrella label for all data subject requests, including erasure, rectification and portability. Strictly speaking, those are separate rights with their own rules, even when the same team and workflow handle them.
What a DSAR entitles a person to receive
Under the GDPR, a valid access request entitles the person to three things: confirmation of whether their data is processed, a copy of the personal data itself, and a set of supplementary information about the processing. The copy must cover data in all systems, including email, chat logs, CRM records, backups in active use and paper files in a filing system.
| Item | What must be explained |
|---|---|
| Purposes | Why the data is processed |
| Categories of data | Types of personal data involved |
| Recipients | Who received or will receive the data, including abroad |
| Retention period | How long data is kept, or the criteria used |
| Source | Where the data came from if not from the person |
| Other rights | Rectification, erasure, restriction, objection and complaint |
| Automated decision-making | Its existence, logic and significance, where it applies |
| Transfer safeguards | Protections for transfers outside the EEA |
A request does not need a special form or wording. It can arrive by email, letter, chat, social media message or phone, and it is valid even if it never uses the words “subject access” or cites the law. Staff who receive customer messages therefore need training to recognize a request when they see one.
Deadlines, fees and verification
Response deadlines are short and strictly enforced by regulators. The clock normally starts when the request is received, not when it reaches the privacy team.
| Parameter | GDPR and UK GDPR | California (CCPA as amended) |
|---|---|---|
| Name of the right | Right of access | Right to know |
| Response deadline | One month | 45 days |
| Extension | Up to two further months for complex or numerous requests | Up to 45 further days with notice |
| Fee | Free; reasonable fee only for excessive or repeat requests | Free, with limits on repeated requests |
| Identity check | Reasonable, proportionate verification | Verifiable consumer request required |
| Requests by others | Through an authorized representative | Through an authorized agent |
Identity verification must be proportionate. Asking for a passport copy from a newsletter subscriber known only by an email address is excessive, while confirming control of the registered account or email is usually sufficient. Over-collecting identity documents creates new privacy risk and can itself breach data minimization.
How organizations process a DSAR
A reliable DSAR process follows repeatable steps and is documented so that the organization can demonstrate compliance if the requester complains to a regulator.
- Log the request with its date of receipt and deadline.
- Verify identity and, where needed, the authority of an agent or representative.
- Clarify scope if the request is unclear, while the deadline generally keeps running.
- Search all systems listed in the record of processing activities, including unstructured data.
- Review and redact third-party personal data and information covered by exemptions.
- Deliver the response securely, in a concise and intelligible form, electronically if the request was electronic.
- Record the outcome, including any refusal and its legal basis.
The search and redaction stages consume most of the effort. A request from a former employee can involve thousands of emails, each of which must be reviewed for colleagues’ personal data, confidential business information and legally privileged material.
DSAR compared with other data subject rights
Because the label is used loosely, it helps to distinguish the access request from the neighboring rights that a person may exercise in the same message.
| Right | What the person asks for | Typical output |
|---|---|---|
| Right of access | Insight into what is held and why | Copy of data plus supplementary information |
| Data portability | Data they provided, in machine-readable form | Structured file such as CSV or JSON |
| Right to erasure | Deletion of their data | Confirmation of deletion or refusal reasons |
| Right to rectification | Correction of inaccurate data | Updated records |
| Right to object | Stop specific processing such as marketing | Processing ceases or reasons given |
Access is often the first step toward other rights: people request their data to find out what to correct, delete or contest. A response that is incomplete or late therefore tends to escalate into complaints about several rights at once.
Exemptions, refusals and common mistakes
The right of access is broad but not unlimited. Organizations may withhold information that would reveal other people’s personal data without their consent, legally privileged advice, trade secrets in some cases, or data covered by specific national exemptions. A request may be refused or charged for only when it is manifestly unfounded or excessive, and the burden of proving that lies with the organization.
- Missing the deadline because the request sat unnoticed in a general inbox.
- Searching only the main database and ignoring email, chat, call recordings and archives.
- Over-redacting so heavily that the response becomes meaningless.
- Refusing because of the requester’s motive, such as a pending dispute, which is generally not a valid reason.
- Sending data insecurely, for example as an unprotected attachment to the wrong address.
Put simply
A DSAR is a person saying to a company: “Show me what you know about me.” Privacy laws give people that right, and the company must answer within a short deadline, usually free of charge.
The answer is not just a list of data. It also has to explain why the data is used, who receives it and how long it is kept. It works like asking a bank for a full statement of your account, except that the account is your personal information.
In practice
A customer of an online furniture retailer in Germany emails customer service asking for “everything you have stored about me” after receiving targeted ads she did not expect. The agent recognizes the message as an access request and forwards it to the privacy team the same day, which logs a deadline of one month.
The team verifies her identity by asking her to confirm the request from her registered account, then searches the shop database, the marketing platform, the customer service tool and the payment provider’s records. The response lists order history, profile data, marketing segments and advertising partners, explains the retention periods and describes her right to object to marketing. She exercises that right immediately, and the case closes within three weeks without a complaint to the supervisory authority.