How to respond to a GDPR data subject access request (DSAR)

A data subject access request, usually shortened to DSAR, is a person asking a company what personal data it holds about them. It is the best known of the GDPR rights and the one that reaches small businesses most often, sometimes from a customer, sometimes from a former employee, and sometimes as a tactic in a dispute. The deadline is short and the rules are precise. Here is how to handle one calmly.

#What is a DSAR?

Article 15 of the GDPR gives a person the right to obtain from you:

1. Confirmation that you process their personal data, or not.
2. A copy of the personal data.
3. Information about the processing: the purposes, the categories of data, the recipients, how long you keep it, where it came from, the existence of automated decision-making, and the safeguards for transfers outside the EEA.
4. A reminder of their other rights, including the right to complain to an authority.

A request does not need to use special words or a form. "Please send me all the data you have about me" is a valid request, in writing or even spoken, and you cannot refuse because it was sent to the wrong address inside your company.

#The deadline

Article 12(3) says you must respond without undue delay and in any event within one month of receiving the request. People often say "30 days", but the legal measure is one calendar month. If the request arrives on the 12th, the answer is due by the 12th of the next month.

You can extend by two further months when the request is complex or you have received many, but you must tell the person within the first month and explain why. If the person asked for additional proof of identity, the clock starts when you have what you need to confirm who they are.

The deadline is the reason it helps to log every request the day it arrives: the date of receipt is the date that counts.

#Step by step

#1. Log it and acknowledge it

Record the date, the channel, the exact wording and a reference number. Send a short receipt saying you have the request and when you will answer.

#2. Check who is asking

You must not give personal data to the wrong person, which would itself be a breach. If you have reasonable doubts about identity, you may ask for additional information (Article 12(6)), but only what is needed: asking everyone for a passport copy is disproportionate. A reply from the email address on the account is often enough for a customer.

#3. Clarify only when you need to

If you hold a lot of data about the person, you may ask them to specify what the request covers. Do this quickly, and do not use it to stall.

#4. Find the data everywhere

List every place that holds personal data: your main application, the CRM, the email platform, support tool, accounting, payment provider, analytics, backups and spreadsheets. Your record of processing activities and your vendor list are the map. Providers that act on your behalf may need to help, which is what your data processing agreements provide for.

#5. Prepare the copy

Send the data in a clear, commonly used format, electronically if the request was made electronically. Redact what concerns other people: the right to a copy must not adversely affect the rights and freedoms of others (Article 15(4)).

#6. Write the reply

Include the copy, the Article 15 information in plain language, and the person's other rights, including how to complain to their supervisory authority. Most of the information is already in your privacy policy, so adapt it to this person.

#7. Send it securely and keep a record

Use a secure channel. Keep the request, your decisions and the reply, so you can show how it was handled. Do not keep a copy of the data longer than needed.

#Can you refuse or charge?

The response is free of charge. You may charge a reasonable fee based on administrative costs, or refuse, only when the request is manifestly unfounded or excessive, in particular because it is repetitive (Article 12(5)). The burden of showing this is yours, so refusals should be rare and documented. If you refuse, you must tell the person within the month, explain why, and tell them they can complain to an authority and seek a judicial remedy.

#What about other requests?

The same deadline applies to the other rights: rectification, erasure, restriction, portability and objection. They are shorter to answer but have their own conditions, for example erasure does not apply when you must keep the data for a legal obligation. In the United States, state laws such as the CCPA/CPRA give a similar set of rights, with a 45-day response period.

#Mistakes to avoid

• Missing the request because it arrived in a support inbox or a social media message.
• Waiting for the end of the month to start.
• Sending data to someone whose identity you did not check.
• Forgetting a system, such as a backup or a spreadsheet.
• Replying with only a table of data and none of the Article 15 information.

#FAQ

#How long do I have to respond to a DSAR?

One month from receiving it. For complex requests or a large number of requests, you can extend by up to two further months, provided you tell the person within the first month and give the reasons.

#Do I have to respond if the person does not use the word "GDPR"?

Yes. A request is valid whatever the wording, as long as it is clear the person wants to access their data.

#Can I ask why the person wants their data?

You should not make the right depend on a reason. Motive is not a condition, although a request made only to cause harm may be refused as manifestly unfounded in rare cases.

#Does the deadline pause while I verify identity?

If you have reasonable doubts and ask for more information, the period runs from the moment you have what you need to confirm identity. Ask quickly and in writing.

#Do I have to search my backups?

Where personal data is held in backups, it falls under the right of access. In practice, explain how backups work and what you could reasonably retrieve, and keep the answer proportionate and honest.

#Who can make a request on someone's behalf?

A representative, such as a lawyer or a parent for a child, can act for the person if they can show authority to do so. Check this before sending any data.

#Sources

• Regulation (EU) 2016/679 (GDPR), Articles 12 and 15, EUR-Lex
• EDPB guidelines on data subject rights