A data subject access request (DSAR) is a request from an individual asking an organisation to confirm whether it processes their personal information and, if so, to provide a copy of it along with details of how it is used.

Where the right comes from

  • GDPR and UK GDPR, Article 15: the right of access. Under Article 12(3), the organisation must respond without undue delay and within one month, extendable by two further months for complex or numerous requests.
  • CCPA, sections 1798.110 and 1798.115: the right to know. Businesses must respond within 45 days, with one 45-day extension when reasonably necessary.
  • POPIA, section 23: a data subject may ask a responsible party to confirm whether it holds their personal information, free of charge, and request a description of it.

The term DSAR is often used loosely for any privacy rights request, including correction and deletion.

What a response usually includes

A copy of the personal information, the purposes of processing, the categories of data and recipients, how long it will be kept, where it came from, and the individual's other rights.

Common pitfalls

Missing the deadline, failing to verify identity before disclosing data, and searching only one system when the person's data sits in several.