DSAR Meaning: What a Data Subject Access Request Is

DSAR stands for Data Subject Access Request, a formal request an individual makes to an organization asking what personal data it holds on them and how that data is being used.

The name is a little misleading. "Access" is only one piece of it. In practice, a DSAR is the umbrella term for a whole set of privacy rights: access, correction, deletion, restriction, portability, and objection. When someone sends a request invoking any of these, most teams still just call it a DSAR.

DSARs exist because of a simple legal principle underneath modern privacy law. Your data isn't really "yours" once you collect it. The person it describes still has a say in how you use it, and a DSAR is how they exercise that say.

Key Takeaways

A DSAR is any request to access, correct, delete, or move the personal data you hold on someone. Access is just the most common form.

Deadlines are strict: one month under GDPR, 45 days under CCPA/CPRA, and missing them is a violation on its own.

Volume is climbing fast. Privacy requests rose 246% between 2021 and 2023 (DataGrail, 2024), so an ad-hoc process no longer scales.

Where Does the DSAR Right Come From?

DSARs aren't new. Public bodies and some industries have handled subject access requests for decades. What changed is scale. Once the GDPR took effect in the EU and the CCPA/CPRA followed in California, DSARs became a routine obligation for almost any business with a website, and the volume kept climbing. Privacy request volume rose 246% between 2021 and 2023 (DataGrail, 2024).

Under the GDPR (Article 15), a data subject has the right to obtain confirmation of whether their data is being processed, and if so, access to that data along with information about the purpose of processing, the categories of data involved, and the recipients (GDPR-Info, Art. 15, 2016). Businesses have one month to respond, with a possible two-month extension for complex requests (GDPR-Info, Art. 12, 2016).

Under the CCPA/CPRA, California residents can request disclosure of the categories and specific pieces of personal information collected, the sources it came from, and the third parties it's shared with. Businesses have 45 days to respond, with one possible 45-day extension, and must offer at least two methods for submitting a request (California Attorney General, 2023).

Other regimes, including UK GDPR, Brazil's LGPD, Canada's PIPEDA, and a growing list of U.S. state laws, mirror this structure closely enough that most companies build one DSAR process and adapt it slightly per jurisdiction.

The single biggest operational difference between the two big regimes is timing. GDPR gives you one month, the CCPA/CPRA gives you 45 days, and both allow an extension that pushes the outer limit to roughly 90 days (GDPR-Info, Art. 12, 2016; California Attorney General, 2023). Blow past either without a valid extension notice and you've committed a violation before you've even addressed the data.

Standard DSAR response deadlines. Both regimes allow an extension to roughly 90 days total. Sources: GDPR Art. 12, California Attorney General.

The wider set of differences is worth keeping in one place:

Aspect	GDPR (EU)	CCPA/CPRA (California)
Standard deadline	1 month	45 days
Extension	+2 months (complex requests)	+45 days (with notice)
Submission methods	No set minimum	At least two required
Fee for a first request	Free (unless unfounded/excessive)	Free
Core disclosure	Data, purposes, categories, recipients	Categories, specific pieces, sources, third parties

What Rights Does a DSAR Cover?

A DSAR can invoke several distinct rights, and knowing which one you're dealing with changes how you respond. The right of access is the most common by a wide margin, but deletion requests are catching up fast: they now make up 56% of all DSARs, up 82% year over year (DataGrail, 2026). Here's the full set:

Right to access, the classic DSAR: "show me what you have on me." This is the most common request by far.
Right to rectification, correcting inaccurate or outdated personal data.
Right to erasure ("right to be forgotten"), deleting the person's data where no overriding legal basis exists to keep it.
Right to restrict processing, where you keep the data but stop actively using it.
Right to data portability, providing the data in a structured, machine-readable format so it can move to another service.
Right to object, stopping specific uses, most commonly direct marketing or profiling.

A single email from a data subject might invoke more than one of these at once, for example "send me everything you have, and then delete it." Your process needs to handle that.

Who Can Submit a DSAR?

Anyone whose personal data you process can file one, not just paying customers. In practice that's a much wider group than most teams expect. It includes:

Website visitors and leads
Newsletter subscribers
Job applicants
Current and former employees
People submitting on behalf of someone else (a parent, a lawyer, a person holding power of attorney)

There's no required format. A request is valid whether it arrives through a dedicated privacy form, a support ticket, an email, or a phone call, and the person doesn't need to say "DSAR" or cite a specific law. "Can you tell me what data you have on me?" is a valid DSAR.

Employee DSARs deserve extra care. They're more likely to be tied to a dispute (a termination, a denied promotion), the data involved is often more sensitive, and most laws prohibit retaliating against an employee for filing one.

What Has to Be Included in a DSAR Response?

The exact content depends on which right was invoked, but GDPR Article 15 sets a clear baseline for an access-type request: confirmation of processing, a copy of the data, and the context around it (GDPR-Info, Art. 15, 2016). In practice, a complete access response usually covers:

Confirmation that you process the person's data
A copy of the actual personal data
The purpose(s) of processing
The categories of data involved
Who it's been shared with (processors, partners, ad and analytics vendors)
How long you'll retain it
Where it came from, if not collected directly from the person
A reminder of their other rights (correction, deletion, objection, complaint to a regulator)

You're not obligated to hand over everything that mentions the person. Internal notes, unrelated business records, and other people's personal data mixed into the same files can be withheld or redacted. Disclosing another person's data by accident in a DSAR response is its own compliance problem.

Can You Say No to a DSAR?

Only in narrow circumstances. GDPR Article 12(5) lets you decline or charge a fee where a request is "manifestly unfounded or excessive," in particular because of its repetitive character, but the burden of proving that sits with you (GDPR-Info, Art. 12, 2016). The two grounds regulators recognize are:

Manifestly unfounded, where the person clearly isn't trying to exercise the right in good faith.
Excessive, for example duplicate requests submitted repeatedly in a short window.

Refusing is a risk to weigh carefully. Regulators expect you to justify it case by case, not by blanket policy, and again, the burden of proof is on you. In most cases it's simpler and safer to just respond.

How to Handle a DSAR: A Working Process

Verify identity. Confirm you're talking to the actual data subject (or their authorized representative) before you disclose anything. Sending someone's data to the wrong person is a breach in itself.
Clarify scope. Work out exactly which right(s) they're invoking and whether the request is broad ("everything") or narrow (a specific record or system).
Locate the data. This is usually the hardest step. Personal data tends to be scattered across a CRM, support tools, analytics platforms, email, backups, and consent and cookie logs.
Review and redact. Strip out other people's personal data and anything outside the DSAR's scope before it goes anywhere.
Package and deliver. Provide the data in a common, accessible format, sent through a secure channel, not a plaintext email attachment.
Log everything. Keep a record of the request, your verification steps, and what was sent, in case you need to demonstrate compliance later.

Why Are DSARs Harder Than They Sound?

Because the legal text is short but the operational reality isn't, and the cost proves it. Gartner estimates a single access or deletion request costs around $1,524 to complete manually (DataGrail, 2026, citing Gartner). Multiply that across rising request volumes and the ad-hoc approach stops being viable. Two problems drive most of the pain:

Data sprawl. A single user might touch a dozen systems, including CRM, billing, support desk, product analytics, email marketing, and ad platforms, each holding a different slice of their data, often with no central index of where it all lives.

Vendor pass-through. If you've shared someone's data with a processor or subprocessor, several laws expect you to relay the DSAR (or the resulting deletion or correction) to them too. That only works if you actually know who has that data.

One category consistently falls through the cracks in DSAR responses: cookie identifiers, tracking IDs, and consent records. GDPR Recital 30 is explicit that online identifiers such as cookie IDs can be used to profile and identify people, which makes them personal data once they're tied to an identifiable browser or device (GDPR-Info, Recital 30, 2016). Yet they usually live in an ad tech or analytics stack that nobody thinks to check when a DSAR comes in.

This is exactly the layer CookieFlux is built to keep organized. It logs what consent a visitor gave, when, and for which tracking categories, so that record, the part of a DSAR response most teams scramble to find, is already sitting in one exportable place instead of buried across cookie banners, tag managers, and ad platforms.

If you're still setting up that consent layer, our guides on what a first-party cookie is and how to subscribe for a cookie banner cover the record-keeping that makes this part of a DSAR painless. For the broader tooling picture, see our roundup of GDPR compliance software for small businesses.

Frequently Asked Questions

Is there a fee for submitting a DSAR? No, not for a standard first request. Under GDPR Article 12(5), fees are only allowed for requests that are manifestly unfounded or excessive, and the organization has to justify that case by case. For everyday access, correction, or deletion requests, the response is free.

How is a DSAR different from a "right to be forgotten" request? Access and erasure are two different rights under the same DSAR umbrella. A DSAR can ask for either, or both at once. The "right to be forgotten" is simply the erasure right, while a plain access request is the "show me what you have" version. One email can invoke both.

Does a request have to mention GDPR or CCPA by name to count? No. Any clear request for someone's personal data, correction, or deletion counts, regardless of the wording used. A customer asking "what information do you keep about me?" in a support chat has filed a valid DSAR, even without naming a law or using the term.

What happens if you miss the deadline? Missing the response window (one month under GDPR, 45 days under CCPA/CPRA) is a compliance violation on its own, separate from whether the data is eventually provided. It can trigger regulatory penalties even if the response itself would otherwise have been fine, so track the clock from day one.