What is a data subject access request (DSAR)?
A data subject access request (DSAR) is a person’s request to an organisation for a copy of the personal data it holds about them, and information about how that data is used. Under the GDPR it must be answered without undue delay and within one month, normally free of charge.
What a response must contain
Article 15 gives the person a copy of their personal data and a set of facts about the processing. The copy has to be complete: emails that mention them, notes in a CRM, support tickets and logs keyed to their account all count.
- The purposes of the processing and the categories of data.
- Who the data has been or will be disclosed to, including recipients outside the EEA and the safeguards used.
- How long the data will be kept, or the criteria for deciding.
- The person’s other rights: rectification, erasure, restriction, objection and the right to complain to a regulator.
- Where the data came from, if not from the person.
- Whether automated decision-making, including profiling, is used, with meaningful information about the logic involved.
Handling a request well
Requests arrive anywhere, so staff who answer customers need to recognise one: no form of words is required. Log each request on the day it arrives, because the clock starts then. Verify identity proportionately, asking only for what you need to be sure, and the clock pauses while you wait for it.
Finding the data is the hard part. Organisations with up-to-date records of processing answer faster, because the record already says which systems hold which categories of data. Before sending, redact other people’s personal data and anything covered by an exemption, and keep a copy of what you sent and when.
Access requests under other laws
California’s CCPA gives consumers a right to know, answered within 45 calendar days and extendable once by a further 45. India’s DPDP Act gives a right to a summary of the personal data processed and the processing activities. Brazil’s LGPD, Singapore’s PDPA and Saudi Arabia’s PDPL have their own access rights and time limits, so a programme that serves several markets has to track the deadline for each regulation separately.
Questions
Data subject access request (DSAR), answered
Can we charge for a DSAR?
Normally no. Under the GDPR you may charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive, for example repetitive, and you must be able to show why.
Does an employee’s request count as a DSAR?
Yes. Current and former employees have the same right of access, and their requests are often the hardest to answer because the data sits in email and HR systems.
What if we hold no data about the person?
Say so in writing within the deadline. A confirmation that no personal data is processed is still an answer to an access request.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them