A data subject access request (DSAR) is a request from a person asking what personal data you hold about them. Under Article 15 of the GDPR, anyone can make one, in any form, and you must reply within one month. You can extend that by two more months if requests are complex or numerous, but you must tell the person within the first month.
Your reply must include a copy of their data plus the purposes you use it for, who you share it with, how long you keep it, where you got it, and their other rights. In most cases you can't charge a fee.
Below: a step-by-step process for handling a DSAR, a response template you can copy, when you can refuse, and how to handle requests at scale.
Table of contents
- What is a DSAR?
- What you must provide
- Deadlines and fees
- How to handle a DSAR, step by step
- DSAR response template
- Can you refuse a DSAR?
- Handling DSARs at scale
- Penalties for getting it wrong
- Access requests outside the EU
- FAQ
What is a DSAR?
A DSAR is how a person exercises their right of access under Article 15 of the GDPR. It applies to any organization that acts as a controller of their personal data, whether a company, a charity or a public body.
- Any form counts. A request can arrive by email, letter, phone, live chat or social media. It does not need to mention the GDPR or use the words "subject access request".
- Anyone can ask about their own data. Customers, employees, former employees, job applicants and website visitors can all make one.
- Someone can ask on another person's behalf, such as a lawyer or a parent, as long as they can show they are authorized.
- The reason does not matter. People do not have to explain why they want their data, and the EU Court of Justice confirmed in 2023 that the first copy must be free even if the request is linked to a dispute.
"DSAR" refers to the right of access specifically. Requests to delete, correct or move data are other data subject rights requests (DSRs), and they have the same one-month deadline.
What you must provide
A DSAR response has two parts: a copy of the personal data, and supporting information about how you use it.
| You must provide | What it means in practice |
|---|---|
| Confirmation | Whether you process their personal data at all |
| A copy of the data | All personal data you hold about them, including in emails, notes, call recordings and logs, not just your main database |
| Purposes | Why you process each type of data |
| Categories of data | For example contact details, billing data, usage data |
| Recipients | Who you share it with, including processors and any recipients outside the EU, with the safeguards used |
| Retention | How long you keep it, or how you decide |
| Source | Where you got it, if not from them |
| Their rights | To correction, deletion, restriction and objection, and to complain to a data protection authority |
| Automated decisions | Whether you make decisions about them by automated means, including profiling, and the logic involved |
Much of the supporting information is already in your privacy notice, so you can adapt that rather than write it from scratch each time. The copy must be intelligible. Raw database exports full of internal codes are not enough on their own, and where a document's context is needed to understand the data, you may need to provide extracts of the document itself.
Deadlines and fees
- One month from the day you receive the request. A request received on 3 March is due by 3 April.
- Up to two more months if the request is complex or you have received several from the same person. You must tell them about the extension, and why, within the first month.
- Identity checks. If you have genuine doubts about who is asking, you can ask for proof of identity. The UK regulator, the ICO, says the clock starts once you receive it.
- No fee in most cases. You can charge a reasonable fee for further copies, or for requests that are manifestly unfounded or excessive.
How to handle a DSAR, step by step
1. Receive and log the request
Record the date received, the requester's details, how the request arrived and what they asked for. Train customer-facing staff to recognize a DSAR in any form and pass it on the same day, because the clock starts when anyone in your organization receives it.
2. Verify the person's identity
Keep checks proportionate. If the request comes from the email address on the account, that may be enough. Do not ask for a passport by default, and do not collect more information than you need to confirm who they are.
3. Search every system
Personal data is rarely in one place. Check:
- Your product database and admin tools
- CRM, support desk and live chat
- Email inboxes and shared drives
- Billing and payment systems
- Analytics and marketing tools
- HR systems, for employee requests
- Backups and logs, if you can reasonably retrieve data from them
Your record of processing activities and subprocessor list are the best starting point, because they list where personal data lives.
4. Review and redact
Remove personal data about other people, unless they have agreed or it is reasonable to disclose it. Check whether any exemptions apply, such as legal privilege. Withhold only what you have to, and keep a note of why.
5. Respond securely
Send the data and supporting information in a commonly used format, such as PDF or CSV, through a secure channel like an encrypted link or a privacy portal. If the request was made electronically, reply electronically unless the person asks otherwise.
6. Keep a record
Log what you sent, when, and anything you withheld and why. If the person complains to a regulator, this record is your evidence.
DSAR response template
Use this as a cover letter with the data you send. Replace anything in [square brackets].
Subject: Your data access request, reference [reference number]
Dear [name],
Thank you for your request of [date] for access to your personal data under Article 15 of the GDPR. We have verified your identity and enclose a copy of the personal data we hold about you.
What we hold and why. We process the following categories of personal data about you: [categories]. We use it to [purposes], on the legal basis of [legal basis for each purpose].
Who we share it with. [Recipients or categories of recipients, including service providers.] [If applicable: Some of this data is transferred outside the EU to [country], protected by [safeguard, for example Standard Contractual Clauses].]
How long we keep it. [Retention period or criteria.]
Where it came from. [You provided it directly / We received it from [source].]
Automated decisions. [We do not make decisions about you based solely on automated processing. / Details of any automated decision-making.]
Information withheld. [None. / We have withheld [description] because [reason, for example it contains personal data about other people].]
Your rights. You can ask us to correct, delete or restrict the use of your data, or object to how we use it. You also have the right to complain to [data protection authority and website].
If you have any questions, reply to this email or contact [privacy contact].
Kind regards,
[Name, role, company]
Can you refuse a DSAR?
Only in limited cases. Under Article 12(5) of the GDPR you can refuse, or charge a reasonable fee, if a request is manifestly unfounded or excessive, for example if it is clearly made to harass you or repeats a request you have just answered. The bar is high, and you must be able to show why the request meets it.
You can also withhold specific information where:
- It would reveal personal data about someone else
- It is covered by legal professional privilege
- A national exemption applies, such as those in the UK Data Protection Act 2018 for crime prevention or management forecasts
- Disclosure would harm trade secrets or intellectual property, though this does not justify refusing the whole request
If you refuse or withhold anything, tell the person within one month, explain why, and tell them they can complain to a data protection authority. Our guide on when you can deny a data subject request covers this in more detail.
Handling DSARs at scale
A single request can take hours if your data is spread across many tools. As volumes grow:
- Give people one place to submit requests, so they do not land in random inboxes.
- Track every request against its deadline, with reminders before it is due.
- Keep an up-to-date map of where personal data lives, so searches are quick.
- Use a standard response template and secure delivery method.
- Keep an audit trail of every step.
ComplyDog gives you a privacy portal on your own domain where people can submit access, deletion and correction requests, and a dashboard to verify, track and complete each one. Start a 14-day free trial, no credit card needed.
Penalties for getting it wrong
Breaches of data subject rights, including the right of access, fall in the higher tier of GDPR fines: up to €20 million or 4% of global annual turnover, whichever is higher. Under the UK GDPR the cap is £17.5 million or 4% of turnover.
In practice, most DSAR failures lead to complaints, regulator orders to respond and reprimands rather than large fines. But ignoring requests, missing deadlines repeatedly or destroying data after a request arrives are the kind of failures that lead to fines.
Access requests outside the EU
- UK: The UK GDPR and Data Protection Act 2018 give the same right, with the same one-month deadline. The Data (Use and Access) Act 2025 confirms you only need to carry out reasonable and proportionate searches.
- California: Under the CCPA, consumers have a "right to know". You must respond within 45 calendar days, extendable once by another 45 days with notice.
- Other US states: Virginia, Colorado, Connecticut, Texas and others give similar access rights, usually with a 45-day deadline.
FAQ
Does a DSAR have to be in writing?
No. Under the GDPR a request can be verbal, made over the phone or sent through social media. It is good practice to confirm it in writing back to the person.
Can I ask why someone wants their data?
You can ask, but they do not have to answer, and you cannot refuse the request because of their reason. You can ask them to clarify what information they want if you hold a large amount.
Do I have to include emails that mention the person?
Yes, if the emails contain their personal data. You provide the personal data about them, not necessarily every email in full, and you redact information about other people.
What if we hold no data about the person?
You still have to reply within one month and confirm that you do not process their personal data.
