Last updated: 29 October 2026

A DSAR (data subject access request) is a request from an individual asking an organisation to confirm whether it holds their personal data and, if it does, to give them a copy along with key facts about how it is used. Under the GDPR and UK GDPR you normally have one month to respond and cannot charge a fee; under South Africa's POPIA and California's CCPA the rules and deadlines differ. This guide explains what a data subject access request is, who can make one, and how to respond step by step, with a deadline table for four regimes and a reply template you can adapt.

What is a DSAR?

A DSAR is the practical name for the right of access. In the EU and UK it sits in Article 15 of the GDPR. The individual (the "data subject") is entitled to:

  1. Confirmation of whether you process personal data about them.
  2. A copy of that personal data.
  3. Supporting information: the purposes of processing, the categories of data, the recipients (especially recipients in third countries), how long you will keep the data or the criteria you use to decide, their rights to rectification, erasure, restriction and objection, their right to complain to a supervisory authority, the source of the data if you did not collect it from them, and whether you use automated decision-making, including profiling.

Where data is transferred outside the EU or UK, the person is also entitled to know which safeguards protect the transfer (Article 15(2)).

You will see the same request described in several ways: "subject access request" or "SAR" (the term the UK regulator uses), "DSAR request", "right to know request" in California, and "request for access to personal information" in South Africa. The obligations behind them are similar but not identical, which is why the jurisdiction section below matters.

What a DSAR is not

  • Not a freedom of information request. FOI and South Africa's PAIA give access to records held by bodies; a DSAR is about the requester's own personal data. In South Africa the two overlap, as explained below.
  • Not a right to documents as such. The right is to a copy of the personal data. Sometimes the easiest way to provide it is a copy of the document, but you can also extract the data, as long as the person gets everything they are entitled to in an understandable form.
  • Not limited to "formal" requests. The EDPB Guidelines 01/2022 on the right of access and the ICO's guide to subject access both make clear that a request does not need particular wording, a form or a reference to the law. The ICO confirms requests can be made verbally, in writing or through social media.

Who can make a DSAR, and how?

Any individual whose personal data you process: customers, website users, employees and former employees, job applicants, suppliers' contacts, and people captured on CCTV. A third party can also make a request on someone's behalf (a solicitor, a parent for a young child, or an authorised agent), but you need to be satisfied they have authority to act.

Requests can arrive anywhere: a support ticket, an email to a sales rep, a phone call, a letter to the registered office, or a direct message. The single biggest operational risk is a request that sits unnoticed in a mailbox while the deadline runs. Train front-line teams to recognise a request and route it to one place on the day it arrives.

DSAR response deadlines by jurisdiction

GDPR (EU) UK GDPR POPIA (South Africa) CCPA (California)
Legal basis Art. 12 and 15 UK GDPR Art. 12 and 15; ICO guidance Section 23, with section 25 applying PAIA procedure Civ. Code §1798.130; 11 CCR §7021
Standard deadline Without undue delay, and within one month of receipt Without undue delay, and within one month of receipt "Within a reasonable time"; under PAIA a private body must decide within 30 days (PAIA s56) 45 calendar days from receipt of the request
Extension Up to two further months where necessary, given complexity and number of requests; tell the person within the first month, with reasons Up to two further months for complex or multiple requests; tell the person within the first month PAIA allows one extension of up to 30 days in listed circumstances (PAIA s57) Once, by up to 45 more days (90 in total), with notice and reasons within the first 45 days
Acknowledgement Not specified Not specified Not specified Confirm receipt within 10 business days
Fee Free; reasonable fee only for further copies or manifestly unfounded or excessive requests Free; reasonable admin fee only for further copies or manifestly unfounded or excessive requests Confirmation is free; a prescribed fee may apply to the record, with a written estimate first Free
Identity May ask for additional information where you have reasonable doubts Must be satisfied of identity; ask only for what is proportionate; the clock starts once you have it Requester must give adequate proof of identity Must verify the consumer; the 45 days run during verification
Lookback All personal data you hold All personal data you hold All personal information you hold 12 months before the request, or longer on request for data collected on or after 1 January 2022

Two details trip teams up. First, under the CCPA the 45-day clock keeps running while you verify identity, so slow verification eats into your response time. Second, under UK guidance the clock does not start until you have the ID, proof of authority or fee you need, and it pauses when you reasonably ask for clarification, resuming the day after the reply arrives. Do not assume the EU, UK and US rules on pausing are the same.

How to respond to a DSAR: step by step

Step 1: Log the request on the day it arrives

Record the date received, the channel, the requester's details, what they asked for, and the jurisdiction(s) that apply. Calculate the deadline immediately and set reminders at the halfway point and a week before it falls due. A central DSAR log is also your evidence of compliance if a regulator asks.

Step 2: Verify identity proportionately

Ask only for what you need. If the request comes from the email address already on the customer's account, that may be enough. Do not demand a passport copy by default: the ICO says formal ID should be requested only where necessary, and over-collecting ID creates new personal data you then have to protect. For agents and representatives, check written authority.

Request ID as early as possible. Under UK guidance the deadline runs from receipt of what you need, but under the CCPA the clock does not stop, and under the GDPR you can ask for more information only where you have reasonable doubts (Article 12(6)).

Step 3: Clarify scope only where it is genuinely needed

If you hold a large volume of data about the person, you can ask them to specify what they are looking for. The ICO is clear that you cannot require them to narrow the request, and if they repeat it, you must still carry out a reasonable search. The UK now expressly requires "reasonable and proportionate" searches, a standard written into law by the Data (Use and Access) Act 2025 and reflected in the ICO's updated guidance.

Step 4: Search every system that may hold their data

This is where a current data map pays for itself. Typical locations:

Area Systems to check
Customer data CRM, billing, support desk, product database, marketing automation, analytics
Communications Email, chat tools, call recordings, social media inboxes
HR data (employee DSARs) HRIS, payroll, performance reviews, recruitment platform, disciplinary files
Security CCTV, access-control logs, device management
Third parties Processors acting on your behalf (cloud hosting, payroll bureau, outsourced support)
Unstructured Shared drives, document management, paper files

Processors must help you here. Under GDPR Article 28(3)(e) your processor contracts must require the processor to assist you in responding to data subject requests. If a vendor cannot export one person's data quickly, that is a finding for your vendor risk assessment and a question to add to your vendor questionnaire.

Step 5: Review, redact and apply exemptions

Read what you found before you send it. You are looking for three things:

  • Other people's personal data. The right to a copy must not adversely affect the rights and freedoms of others (Article 15(4)). The ICO's approach is a three-step test: does the information identify someone else; has that person consented; and if not, is it reasonable to disclose without consent?
  • Exemptions. These are national. The UK has exemptions in the Data Protection Act 2018 (for example legal professional privilege and management forecasting). In South Africa, POPIA section 23(4) imports the PAIA grounds for refusal. Record which exemption you relied on and why.
  • Information that is not personal data about the requester. Business information that does not relate to them can be left out.

Where only part of the information can be withheld, disclose the rest. POPIA states this expressly in section 23(5), and the same principle applies in practice under the GDPR.

Worked example: an employee DSAR

A former employee asks for "all emails that mention me". The search finds 1,400 emails. The reviewer:

  1. Removes duplicates and emails where the employee's name appears only in an automated signature or distribution list with no information about them.
  2. Keeps emails that contain information about the employee (performance comments, absence discussions, the exit process).
  3. For each email, identifies colleagues named in it. Where a colleague's role is already known to the requester and the content is about the requester, disclosure is often reasonable. Where an email contains a colleague's own personal circumstances, that part is redacted.
  4. Checks legal advice emails for legal professional privilege before release.
  5. Logs each redaction category so the decision can be explained if challenged.

The output is the employee's personal data with redactions, a covering letter explaining the supporting information, and an internal record of the review. The goal is to give the person their data, not every email in full.

Step 6: Decide whether the request is manifestly unfounded or excessive

Under the GDPR you may refuse, or charge a reasonable fee, where a request is manifestly unfounded or excessive, "in particular because of their repetitive character" (Article 12(5)). The burden of proof is on you, and the ICO describes the threshold as high. A request made as part of a dispute is not automatically unfounded. If you refuse, you must tell the person without delay, and at the latest within one month, explaining why and informing them of their right to complain to the regulator and to seek a judicial remedy (Article 12(4)).

Step 7: Respond securely and in the right format

If the request was made electronically, provide the information electronically unless the person asks otherwise (Articles 12(3) and 15(3)). Use a secure method: an encrypted file with the password sent separately, or a secure portal. In South Africa, you must tell the person of their right to request correction of the information (POPIA section 23(2)).

Step 8: Close and record

Store the request, the ID check, the search log, redaction decisions, the response and the date sent. Track volumes, average response time and missed deadlines. Those numbers show whether your process works and give you evidence if a complaint reaches the regulator.

DSAR response template

Adapt this to your jurisdiction and get legal sign-off before using it.

Subject: Your data subject access request (ref. [reference])

Dear [name],

Thank you for your request of [date received], which we have handled as a request for access to your personal data under [Article 15 UK GDPR / Article 15 GDPR / section 23 POPIA / the CCPA].

1. Do we hold your personal data? Yes. A copy is enclosed in [format], sent [method].

2. Why we use it: [purposes and lawful bases].

3. What we hold: [categories of personal data].

4. Who we share it with: [recipients or categories of recipient, including any outside the UK/EU and the safeguards used].

5. How long we keep it: [retention periods or criteria].

6. Where it came from: [sources, if not collected from you].

7. Automated decisions: [whether we use automated decision-making or profiling, and meaningful information about the logic involved].

8. Information we have withheld: [what, and the exemption or reason, unless saying so would itself prejudice the purpose of the exemption].

9. Your rights: You can ask us to correct, delete or restrict your data, or object to its use. You can also complain to [ICO / your EU supervisory authority / the Information Regulator].

Yours sincerely, [name, role, contact details]

For a POPIA request, add the PAIA form references your organisation uses. The Information Regulator publishes PAIA Form 02 (Request for Access to Record) and related forms.

DSARs in South Africa: how POPIA and PAIA fit together

This is the area most international guides skip. POPIA section 23 gives a data subject who provides adequate proof of identity the right to ask a responsible party to confirm, free of charge, whether it holds personal information about them, and to request the record or a description of it, including the identity of all third parties, or categories of third parties, who have or had access to it. The response must come within a reasonable time, at a prescribed fee if any, in a reasonable manner and format, and in a generally understandable form.

Section 25 then applies sections 18 and 53 of the Promotion of Access to Information Act (PAIA) to these requests, so the PAIA request procedure is the practical route. For a private body, PAIA requires a decision as soon as reasonably possible and within 30 days, with one extension of up to 30 days in specified circumstances. If you charge a fee, POPIA section 23(3) requires a written estimate first and allows you to ask for a deposit.

Practical points for South African organisations:

  • Make sure your PAIA manual explains how to make a request and names your information officer. Our POPIA compliance guide covers the wider programme.
  • Treat "within a reasonable time" as no longer than the PAIA timeline. Building a process around 30 days also keeps you close to the GDPR one-month standard if you serve EU customers.
  • Remember the right to correction under section 24 sits next to access. Tell the person about it in every response.

New to the Act? Start with what POPIA means.

DSARs in California: the right to know

The CCPA calls this the right to know. Businesses must offer at least two methods for submitting requests, including at minimum a toll-free telephone number; a business that operates exclusively online and has a direct relationship with consumers only needs to provide an email address (§1798.130(a)(1)(A)). You must confirm receipt within 10 business days and respond within 45 calendar days, extendable to a maximum of 90 with notice (11 CCR §7021). If you cannot verify the consumer within the 45 days, you may deny the request. For California's wider privacy landscape, see our explainer on CalPrivacy.

Common DSAR mistakes

  • Missing the start date. The clock usually starts when the request reaches any part of the organisation, not when the privacy team sees it.
  • Over-asking for ID. Demanding documents you do not need delays the response and can itself be challenged.
  • Forgetting processors. Data held by vendors on your behalf is still your data for DSAR purposes.
  • Sending everything unredacted. Disclosing colleagues' or customers' personal data in a DSAR response can itself be a personal data breach.
  • Sending only the data. Under the GDPR and UK GDPR the supporting information (purposes, recipients, retention, source, rights) is part of the response.
  • No record. If you cannot show what you searched and why you withheld something, you will struggle to defend the response.

Frequently asked questions

How long do you have to respond to a subject access request?

Under the GDPR and UK GDPR, without undue delay and within one month of receipt, extendable by up to two further months for complex or numerous requests if you tell the person within the first month. Under the CCPA, 45 calendar days, extendable once to a maximum of 90. Under POPIA, within a reasonable time, with PAIA's 30-day decision period (extendable once by up to 30 days) as the practical benchmark for private bodies.

Can you charge for a DSAR?

Generally no under the GDPR, UK GDPR and CCPA. Under the GDPR you may charge a reasonable fee for further copies or where a request is manifestly unfounded or excessive. Under POPIA, confirming whether you hold information is free, but a prescribed fee may apply to providing the record, with a written estimate given first.

Does a DSAR have to be in writing?

No. Under the GDPR and UK GDPR a request can be made verbally or in writing, including through social media, and does not need to mention the law. Record verbal requests and confirm the details back to the person in writing.

What counts as a manifestly unfounded or excessive request?

Examples include requests made purely to cause disruption with no real intention of exercising the right, or the same request repeated at short intervals with nothing having changed. You carry the burden of demonstrating it, and the threshold is high, so document your reasoning.

Do you have to provide whole documents?

No. The right is to a copy of the personal data, not to documents as such. Providing a document can be the simplest way to do it, but extracts are acceptable if the person receives all their personal data in an understandable form, with other people's information redacted where appropriate.

What is the difference between a DSAR and a SAR?

None in substance. "SAR" (subject access request) is the term used in UK guidance; "DSAR" adds "data" and is more common in the EU and US. Both describe a request under the right of access.

Manage DSARs in one place

Most DSAR failures are process failures: requests nobody logged, deadlines nobody tracked, and systems nobody knew held the data. Core GRC's DSR management module gives you a single intake and log for privacy rights requests, deadline tracking by jurisdiction, and a link to your data map and vendor records so you know where to search. See our privacy rights intake whitepaper or explore the Core GRC modules.

This article is general information, not legal advice. Check the current text of the law and regulator guidance that applies to you.

Cover photo by Viktor Talashuk on Unsplash