What businesses need to know about DSARs
A DSAR lets people see the personal data you hold about them. Under GDPR, you usually have one month to provide a copy and key details at no cost.
Data subject access requests (DSARs) in 2026: the complete guide
A data subject access request (DSAR) is a request from an individual to see the personal data your organization holds about them. Under the GDPR, you usually have one month to confirm whether you process their data, send them a copy, and explain how you use it.
If your business receives a DSAR, you need to know what information to provide, when you must respond, and when you can refuse a request. This guide explains these requirements and how to prepare your team to handle requests.
DSAR requirements at a glance
Topic | What the GDPR requires | What to do |
|---|---|---|
Recognizing a request | Any request to access personal data counts, in any format or channel | Train teams who handle email, chat, and social messages to spot and forward requests |
Who can ask | Any individual whose data you process, or someone authorized to act for them | Check identity or authority only as far as needed |
What to provide | Confirmation, a copy of the data and specific supplementary information | Prepare a standard response structure |
Deadline | One month, extendable by two further months for complex or numerous requests | Log the date of receipt and track the deadline |
Fee | Free in most cases | Charge only for extra copies or manifestly unfounded or excessive requests |
Refusing or limiting | Only on narrow grounds, explained to the requester | Document the reason and tell the requester how to complain |
What is a data subject access request (DSAR)?
A DSAR is how an individual uses their right of access under Article 15 of the GDPR: the right to see their personal data and understand how your organization uses it.
In the UK, these requests are usually called subject access requests (SARs). A data subject request (DSR) is a broader term that also covers other privacy rights, such as deletion and correction. Our guide to data subject rights covers those.
Does a DSAR have to be in writing or mention the GDPR?
No. A request can arrive by email, web form, phone, letter, chat or social media, and it does not need to use the words "DSAR," "subject access" or "GDPR." If someone asks for the personal data you hold about them, treat it as a DSAR, even if it arrives through a channel other than the one you prefer (EDPB Guidelines 01/2022).
Missing a request can be costly. In 2024, Belgium's data protection authority fined a telecom operator €100,000 after it failed to properly handle an access request sent through Messenger.
Who can make a DSAR?
Anyone whose personal data you process can make a DSAR: customers, website visitors, newsletter subscribers, job applicants, current and former employees, and contractors. They do not have to explain why they want the information.
Someone else can also make a request on a person's behalf, such as a lawyer or the parent of a young child. In that case, check that they have the authority to act, for example, a signed authorization.
What must you provide in response to a DSAR?
You must confirm whether you process the person's data and, if you do, give them a copy of their personal data plus the supplementary information listed in Article 15(1) and (2).
What to provide | What it means in practice |
|---|---|
A copy of the personal data | The personal data covered by the request, presented in an understandable format |
Purposes | Why you process their data |
Categories of data | For example, contact details, purchase history or usage data |
Recipients | Who receives the data, including service providers and other third parties |
Retention period | How long you keep the data, or the criteria you use to decide |
Their other rights | Rectification, erasure, restriction, objection, and the right to complain to a supervisory authority |
Source | Where you got the data, if not from the person |
Automated decision-making | Whether it is used, including profiling, with meaningful information about the logic and likely consequences |
International transfers | The safeguards you rely on if the data goes outside the EU |
Your response must contain the person's actual data, not just a description of what your company collects. EU court rulings have also clarified that people may be entitled to know the specific recipients of their data and, where needed, to copies of documents or extracts to understand their information.
Avoid generic privacy notice text. An EDPB review of 1,185 organizations found that some businesses gave general privacy information instead of details specific to the requester. If the request was made electronically, reply in a commonly used electronic format unless the person asks otherwise.
How long do you have to respond to a DSAR?
Under the GDPR, you must respond without undue delay and within one month of receiving the request (Article 12(3)). You can extend this by two further months if requests are complex or numerous, but you must tell the person about the extension and why, within the first month.
UK rules also allow organizations to pause the deadline in certain circumstances and limit searches to what is reasonable and proportionate. See our guide to DSAR time limits for details.
How to verify the requester's identity
Request identification only when you have reasonable doubts about the person's identity (Article 12(6)). For example, a request from an email address already linked to a customer account may not need further verification.
Avoid routinely asking for passports or other identity documents. Use the least intrusive method to confirm the requester's identity, and decide in advance what you will accept for customers and employees.
When can you refuse or limit a DSAR?
When can you refuse a request?
Only in narrow circumstances: when a request is manifestly unfounded or excessive (Article 12(5)). A repeated request for the same data shortly after you answered may qualify. A request that is large or inconvenient usually does not, and wanting the data for a dispute is not, on its own, a reason to refuse (CJEU, C-307/22). You must be able to show why the exception applies.
Can you withhold some information?
Yes, in specific cases. You may need to redact information that would affect other people's rights, such as colleagues named in emails or trade secrets (Article 15(4)). National exemptions can also apply, such as those for legally privileged material and confidential references in the UK's Data Protection Act 2018. Withhold only what the exemption covers and provide the rest.
What happens if you refuse?
You still have to reply within one month. Explain why you are not acting on the request, and tell the person they can complain to a supervisory authority or go to court (Article 12(4)). Keep a record of your reasoning.
Employee DSARs: what's different?
Employee DSARs follow the same rules as other access requests, but they can be harder to manage because personal data is spread across HR records, emails, internal messages and managers' notes.
Pay particular attention to:
Emails and messages: Provide the employee's personal data, with enough context to understand it, without automatically handing over every document that mentions them.
Other employees' information: Review and redact colleagues' personal data where necessary.
Searching for records: Identify the relevant systems and document how you searched.
Involve HR, IT and legal early, especially when the request is part of an employment dispute. Preserve relevant information while you handle the request: in the UK, deleting data to prevent its disclosure is a criminal offense.
How to handle a DSAR: the process at a glance
Every DSAR follows a similar process, from receiving the request and verifying identity to locating personal data and preparing a response. The diagram below summarizes it. For detailed instructions, see our guide to responding to a DSAR.
How to prepare your business for DSARs
Most DSAR failures happen before anyone starts searching for data: the request is missed, sent to the wrong person, or noticed too late. These five steps help you prepare.
1. Give people a clear way to submit requests
Legal requirement: GDPR Art. 12(2) and Art. 13(2)(b)
Provide a request form or a dedicated email address and explain how to use it in your privacy notice. People can still submit requests through other channels, so the form should make the process easier, not restrict it.
How to check it: Follow your privacy notice's instructions as a customer would. Note how many steps it takes and whether anything forces people to create an account or use a single channel.
2. Train frontline teams to spot and forward requests
Regulator expectation: EDPB Guidelines 01/2022
Customer support, sales, HR, and social media teams usually see requests first. They need to recognize a plain-language request and know where to forward it the same day.
How to check it: Send a test request through your support chat or a social channel, such as "Can you send me all the information you have about me?" Time how long it takes to reach the person responsible.
3. Map where personal data lives
Legal requirement: GDPR Art. 15 and Art. 5(2) (accountability)
Identify where personal data is stored, including your CRM, email, support tools, HR systems, and other relevant platforms. Assign an owner to each system so your team knows where to look when a request arrives.
How to check it: Pick a test customer and try to find all their data within a day. Any system you missed belongs on the list.
4. Assign an owner and track every deadline
Legal requirement: GDPR Art. 12(3)
Name one person or team responsible for DSARs, with a backup for absences. Log each request with its receipt date, deadline, and status so nothing depends on a single inbox.
How to check it: Ask the owner how many requests are open today and when each one is due. If the answer takes more than a few minutes, the log needs work.
5. Prepare standard wording and keep records
Best practice: GDPR Art. 5(2) (accountability)
Standard wording for acknowledgments, identity checks, extension notices and final responses saves time and keeps answers consistent. Keep a record of each request and what you did, and set a retention period instead of keeping them indefinitely.
How to check it: Pull the file for your most recent request. It should show when it arrived, what you sent, and when.
How Clym helps manage DSARs
Clym helps businesses collect, track, and respond to data subject requests in one place.
Request intake: Collect requests through the Governance Portal, or add those received elsewhere manually.
Deadline tracking: Track response deadlines based on the applicable regulation and receive email reminders as they approach.
Verification and routing: Manage identity checks, route requests to the right team, and follow their progress.
Responses and records: Reply using response templates and keep a record of each request and its communications.
Conclusion
Most DSAR problems come from missed or misrouted requests and generic answers, not from the law itself.
Set up a clear intake route, know where personal data lives, and track every deadline, so each request gets a complete answer on time.
This article is for general information and is not legal advice. For advice on your specific situation, consult a qualified privacy lawyer.
Frequently asked questions
Log the request with the date it arrived, because the one-month deadline starts then. Send a short acknowledgment, ask for identification only if you have reasonable doubts, and pass the request to the person responsible for DSARs. Our guide to responding to a DSAR covers the full process.
It can. The GDPR can apply to US companies that offer goods or services to people in the EU or monitor their behavior there (Article 3(2)). California and other US states have their own access rights; see our guide to CCPA data subject requests.
The person can complain to a supervisory authority, which can order you to respond and impose a fine. You can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher, and individuals can also claim compensation (Articles 82 and 83(5)).
Yes. The right of access includes confirmation of whether you process someone's data, so tell the requester you hold none. A short written reply also creates a record that you handled the request.
Compliance Content Manager | CIPP/E (IAPP) | CPACC (IAAP)
Alex is a Compliance Content Manager at Clym, where he researches and writes about everything related to data privacy and web accessibility compliance for businesses, helping them stay informed on their compliance needs and spreading awareness about making the web safer and more inclusive. When he's not writing about compliance, Alex has his nose in a book or is hiking in the great outdoors.
