What is a GDPR data subject access request (DSAR)?

A data subject access request, usually shortened to DSAR, is one of the most common demands a business receives under the GDPR, and one of the easiest to mishandle. It is a person using their Article 15 right of access to find out what personal data you hold about them and to get a copy. There is no special form, no fee for the first copy, and a hard one-month clock.

What is a data subject access request?

Article 15(1) gives every data subject the right to obtain confirmation of whether you are processing their personal data and, where you are, access to that data plus a defined set of information: the purposes of the processing; the categories of personal data; the recipients or categories of recipient, including any in third countries; the envisaged storage period or the criteria used to set it; the existence of their rights to rectification, erasure, restriction and objection; the right to lodge a complaint with a supervisory authority; the source of the data where you did not collect it from them; and the existence of any automated decision-making, including profiling, with meaningful information about the logic involved.

Do you have to provide a copy, and can you charge?

Yes. Article 15(3) requires you to provide a copy of the personal data undergoing processing, and the first copy is free. You may charge a reasonable fee based on administrative costs only for further copies, or, under Article 12(5), where a request is manifestly unfounded or excessive, in which case you may charge a reasonable fee or refuse. Where the person asks by electronic means, provide the information in a commonly used electronic form unless they ask otherwise. Article 15(4) adds that the right to a copy must not adversely affect the rights and freedoms of others, which is why you redact third-party data.

How long do you have to respond?

Article 12(3) sets the deadline: without undue delay, and in any event within one month of receiving the request. You can extend by two further months where the request is complex or numerous, provided you tell the person within the first month and explain the delay. Because the clock starts on receipt, and a DSAR can arrive by email, chat, or in passing, the practical risk is missing a request rather than answering it wrongly.

How to handle a DSAR without slipping up

The common failures are treating an informal message as not counting, missing data held in scattered systems, and releasing another person's data by accident. Recognise a request in any format, confirm the requester's identity, search across your systems, and redact information about other people before you send. A current record of processing activities makes the search far quicker, and a person who asks for access will often follow with an erasure request.

Next step

If DSARs land unpredictably and you are not sure your process meets the one-month deadline, the free 2-minute Obligation Scan checks whether the GDPR applies to you and which data-subject-right processes, including access, you need in place. The GDPR compliance hub sets out the wider duties and how they connect.