A DSAR is a data subject access request: a request from an individual asking an organisation what personal data it holds about them, and for a copy of it. Under GDPR the organisation normally has one month to respond, and it can extend that by up to two further months for complex or numerous requests. If you run a business, you will receive these sooner or later, and the ones that go wrong usually go wrong on process, not on law.
This guide explains the rules in plain terms and then walks through how to run a request from intake to reply. If you handle more than a handful a year, our data privacy and GDPR operations automations are built for exactly this work.
What does DSAR stand for?
DSAR stands for data subject access request. The “data subject” is the person the data is about, and the “access” is the right in Article 15 of GDPR to confirm whether you process their data, get a copy, and receive some supporting information. That supporting information includes the purposes of processing, who the data is shared with, how long it is kept, and where it came from if not from the person themselves.
Some people call it a SAR (subject access request). It is the same thing. The request does not have to use either term. A customer emailing “please send me everything you have on me” has made a DSAR, and the clock has started.
Who can make a DSAR?
Any living individual whose personal data you process can make one. That covers customers, website visitors, former and current employees, job applicants, contractors and suppliers who are sole traders.
A third party can also make a request on someone’s behalf, such as a solicitor, a family member or a representative, but you should ask for proof that they are authorised. You may also ask for proof of identity if you have reasonable doubt about who is asking. Ask for the minimum needed, and ask promptly, because identity checks should not become a way to run down the clock.
Requests do not need a form, a fee or a particular channel. They can arrive by email, post, social media, a phone call, or to the wrong person in the company. Staff need to know to pass them on the same day.
DSAR response time and time limit
The standard DSAR time limit is one month from receiving the request (or from receiving any identity information you reasonably asked for). You can extend by up to two further months if the request is complex or the person has made several requests, but you must tell them within the first month and explain why.
Two practical points. First, count in calendar months and note the date the clock starts; do not guess. Second, an extension is for genuine complexity, such as a large volume of data across many systems, not for a team that is busy.
You can only refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive, and you should document the reasoning if you take that route.
ICO DSAR guidance, and what applies in Malta
The ICO is the Information Commissioner’s Office, the UK regulator, and it publishes detailed and widely used guidance on subject access, which is why many searches for DSAR help point there. In Malta the regulator is the Information and Data Protection Commissioner (IDPC). The UK has its own UK GDPR and Data Protection Act 2018, while Malta applies the EU GDPR together with its Data Protection Act. In substance the right of access works the same way in both, but the exemptions and procedural details differ. If you operate in Malta, treat the ICO’s guidance as a helpful practical reference and check specifics against the IDPC’s guidance and your own adviser.
We have covered the wider compliance picture in our guide to GDPR and AI automation in Malta.
What data does a DSAR cover?
Personal data means anything that relates to an identifiable person. In practice that includes:
- Records in your CRM, HR system, billing system and support tool
- Emails and chat messages that mention or concern the person
- Call recordings, CCTV footage and meeting notes
- Spreadsheets, shared drives and, often forgotten, backups and archives
- Data held by processors on your behalf, such as a marketing platform or payroll provider
It is not a right to documents as such. The person is entitled to their personal data, so a long email thread may need to be provided in part, with other people’s details removed. Systems like HubSpot, Microsoft 365 and Zendesk tend to hold most of it, and the search usually has to cover all of them.
DSAR exemptions
Not everything has to be disclosed. The common exemptions and limits, in general terms:
| Situation | What it generally means |
|---|---|
| Other people’s data | You may need to redact or withhold third-party data unless they consent or it is reasonable to disclose |
| Legal professional privilege | Privileged legal advice can be withheld |
| Confidential references | References given in confidence may be exempt in some cases |
| Crime and tax purposes | Disclosure can be withheld where it would prejudice certain investigations |
| Manifestly unfounded or excessive requests | You can refuse or charge a reasonable fee, with documented reasons |
The precise wording and scope of exemptions vary by country and by national law, so confirm with your adviser before relying on one. Always record which exemption you applied and why, because the person can complain to the regulator.
How to handle a DSAR, step by step
- Log it the day it arrives. Record the date, channel, who it is from and what they asked for. Set the deadline immediately.
- Verify identity if needed. Ask once, ask for the minimum, and note when the clock restarts if you do.
- Clarify scope only if necessary. If you process a lot of data, you may ask the person to specify what they want. Continue the search meanwhile where you can.
- Search every system. Use a checklist of data sources, including email and shared drives.
- Review and redact. Remove third-party data, privileged material and anything exempt.
- Prepare the response. Provide a copy of the data in a clear, accessible format, plus the supplementary information about purposes, recipients and retention.
- Send securely and record it. Use an encrypted channel, keep a record of what was sent, and keep the file for your accountability records.
There is no official DSAR request template you must use, and requesters do not have to use one either. A simple acknowledgement and response template saves time and keeps your wording consistent.
Where DSARs go wrong
- Missed deadlines. The request sat in a shared inbox or went to someone on leave.
- Incomplete searches. Email and chat are searched but the old CRM or a spreadsheet is not.
- Over-redaction or under-redaction. Black bars on the wrong things, or a colleague’s name left in.
- Sending too much. Including another customer’s data, or internal commentary that should have been reviewed.
- No record. Nobody can show what was searched or why something was withheld.
Where AI helps, and where a person must decide
AI is good at the heavy, repetitive parts. It can classify an incoming message as a DSAR, extract the requester’s details, set the deadline, search connected systems for matches, summarise large document sets, and flag text that looks like third-party personal data for redaction. Tools like OneTrust are used for privacy case management, and workflow tools such as n8n can connect the systems to search.
A person must decide anything that involves judgement: whether an exemption applies, whether a request is manifestly excessive, whether to extend, and the final sign-off on what leaves the building. AI should draft and flag, not release. Keep the data inside your own environment where possible, because a DSAR tool that sends everyone’s personal data to a third-party model creates a new compliance problem.
You can see how this looks in practice in our DSAR request intake and fulfilment automation, and the related DSAR volume and SLA reporting and data subject access request intake and routing jobs.
Frequently asked questions
What is a DSAR in simple terms?
It is a request from a person to see the personal data an organisation holds about them. The organisation must confirm whether it holds data and provide a copy, along with some information about how it is used.
How long do you have to respond to a DSAR?
One month from receipt, extendable by up to two further months for complex or numerous requests. You must tell the person about the extension within the first month.
Can you charge for a DSAR?
Generally no. A reasonable fee is only possible for manifestly unfounded or excessive requests, and you should document your reasoning.
Does a DSAR have to be in writing?
No. A verbal request is valid, which is why staff training matters.
Where Automata fits
We build ready-made automations for privacy operations: DSAR intake and deadline tracking, system search, redaction flagging, response drafting and reporting. You can browse them in our data privacy and GDPR operations category, with the main workflow being DSAR request intake and fulfilment. Each one keeps a person in the loop for exemptions and final release. This guide is general information, not legal advice, so confirm your obligations with your data protection adviser.
If you want to see how this would work with your systems, get in touch.