All You Have to Know About a DSAR

Simply put, it's a data subject access request. You'll also see it written as a DSAR request, or simply a subject access request (SAR) in the UK. In any case, the meaning remains the same. The "data subject" is the person the data is about – a customer, employee, job applicant, or website visitor. The right comes from Article 15 of the GDPR in the EU, the UK GDPR, and the CCPA/CPRA in California, with similar rights now written into most US state privacy laws, Canada's PIPEDA, and Brazil's LGPD. Access requests are one piece of a bigger obligation set – our data privacy compliance guide maps how they fit alongside the rest.

The scope is wider than people expect. A DSAR doesn't just cover the account record in your CRM. It reaches emails that mention the requester, support tickets, call recordings, HR files, Slack messages, access logs, and backup archives – anything that identifies them, directly or indirectly. If you're unsure what counts as personal data, start with our guide to what is PII.

Any individual whose data you process can submit one – and they don't need a reason, a lawyer, or a special form. A request made verbally, by email, or through a social media message is still valid under GDPR. Common requesters include:

• Employees and ex-employees, often during a dispute or before a tribunal claim
• Customers checking what a company knows about them or preparing a complaint
• Job applicants who suspect discrimination in hiring
• Authorized agents acting on someone's behalf (explicitly allowed under CCPA)

You can – and should – verify the requester's identity before releasing anything. Sending someone's file to an impersonator is itself a data breach. But verification must be proportionate: you can't demand a notarized passport copy for a newsletter subscription.

The clock starts when the request arrives, not when it reaches the right department.

Two practical notes. First, the GDPR's "one month" means the same calendar date next month – a request received January 31 is due February 28. Second, an extension is not a pause: regulators expect you to acknowledge the request, explain the extension, and keep working.

If you operate across US states, the CCPA numbers are a good default: Virginia, Colorado, Connecticut, and most other state privacy laws also use a 45-day window with a 45-day extension. Building your DSAR process around the strictest law you're subject to – usually the GDPR's one month – keeps every other deadline covered automatically.

A compliant response is a copy of the data plus the story around it. Under GDPR Article 15, you must provide:

1. A copy of the personal data itself – in a commonly used electronic format if the request came electronically
2. The purposes you process it for
3. The categories of data involved
4. The recipients you've disclosed it to, including processors and international transfers
5. The retention period, or the criteria you use to set one
6. The source of the data, if you didn't collect it from the person directly
7. Whether automated decision-making or profiling is involved, with meaningful logic explained
8. Their other rights – rectification, erasure, restriction, and the right to complain to a regulator

The CCPA list is similar: categories collected, sources, business purposes, third parties data was shared or sold to, and the specific pieces of personal information.

Step 1. One should log and acknowledge. Then you record the date received and send an acknowledgment stating the deadline. Train frontline teams to recognize requests: a DSAR buried in a support ticket still starts the clock.

Step 2. Do the verification of your identity. Match the requester to the data using information you already hold. For agents, confirm the authorization.

Step 3. Now, you search everything. Pull from structured systems (CRM, HR, billing) and unstructured ones (email, chat, shared drives, recordings). This is where most of the DSAR effort actually goes – and where most omissions happen.

Step 4. Apply exemptions. Not everything found goes out. Legal privilege, ongoing investigations, trade secrets, and – critically – other people's personal data can or must be withheld. Privileged material follows the same rules as any legal document redaction: withhold the protected content, note the basis. Document every exemption you rely on; regulators ask.

Step 5. Redact, then verify. Remove third-party data and exempt content from the documents themselves. This step has to be permanent: a cosmetic black box over live text can be copy-pasted away – the most common redaction failure we see in DSAR releases. It's also crucial to check hidden layers. A PDF can carry names in its properties and revision history long after the visible text is clean. For that reason, a step to remove metadata from a PDF belongs in the release checklist.

Step 6. Deliver securely and keep a record. Send through a secure channel, not a plain email attachment, and log what you disclosed, what you withheld, and why.

If you get more than a handful of requests a year, turn these steps into a documented DSAR workflow with named owners – regulators treat a repeatable process as evidence of compliance in itself.

Here's the structural problem with DSARs. The requester has a right to their data – but almost every real document mixes their data with someone else's. An email thread names colleagues. A complaint file quotes witnesses. An HR investigation contains statements given in confidence. GDPR Article 15(4) is explicit: the right to a copy "shall not adversely affect the rights and freedoms of others."

So before anything is released, someone has to go through every page and remove the other names, emails, opinions, and identifiers – without touching the requester's own data. Done by hand across hundreds of pages, this is slow and error-prone, and a single missed name converts a compliance exercise into a reportable breach.

This is exactly the workload DSAR redaction software is built for: it detects personal identifiers across the document set, lets you keep the requester's data while permanently removing everyone else's, and produces files where the redactions can't be reversed – even in scanned PDFs.

All the failures in DSAR compliance usually happen in the GDPR's upper fine tier. If violations of data subjects' rights happen, they can draw penalties up to €20 million or 4% of global annual turnover, whichever is higher. In practice, regulators fine at the lower end but publish the decisions – the reputational hit often outweighs the penalty. Under the CCPA, each violation carries up to $2,500 in civil penalties, or $7,500 if intentional, and California's enforcement sweeps have repeatedly targeted ignored consumer requests.

The quieter risk is litigation. DSARs are routinely used as pre-action discovery in employment disputes; a late or incomplete response hands the other side an easy procedural win.