GDPR › Personal data

What is a DSAR? Data subject access requests, time limits and how to respond

A DSAR is a request from a person for a copy of the personal data you hold about them. You have one month to answer, extendable by two further months. Here is what to provide, when you can refuse or charge, and a step-by-step process with a checklist you can copy.

A DSAR, or data subject access request, is a request from an individual asking an organisation to confirm whether it processes their personal data and, if it does, to give them a copy of that data along with information about how it is used. Under the GDPR you must respond without undue delay and at the latest within one month of receiving the request. If the request is complex, or the person has sent several, you can extend that by two further months, provided you tell them within the first month and explain why.

The right behind the request is the right of access in Article 15 GDPR. The time limits, fees and refusal rules sit in Article 12. This article covers both, together with the European Data Protection Board's (EDPB) final Guidelines 01/2022 on the right of access, and closes with a short note for organisations that also answer requests under the UK GDPR.

What does DSAR mean?

DSAR stands for data subject access request. The "data subject" is the person the data is about. The UK regulator, the ICO, usually just says subject access request, or SAR. The two terms mean the same thing.

A DSAR is a request to see your own data. People sometimes use the term loosely for any privacy request, such as erasure or rectification, but those are separate data subject rights with their own conditions. If one email asks for access and erasure, treat it as two requests that share a deadline.

Three points from the EDPB guidelines catch many organisations out:

No set format. A request can arrive by email, web form, letter, phone, chat or a social media message. The GDPR does not prescribe a format.
No magic words. The person does not have to write "DSAR", "Article 15" or "GDPR". It is enough that they want to know what personal data you process about them, and you cannot refuse because the legal basis was not named.
No reasons needed. The requester does not have to say why they want the data, and you cannot make the answer depend on their motive.

Anyone whose personal data you process can make a request: customers, users, employees and former employees, job applicants, suppliers' contacts and prospects. A third party can also make one on the person's behalf, such as a parent for a child, a solicitor for a client or an online portal the person uses to send requests. You are entitled to check that the third party really has authority to act.

DSAR time limit: one month, and when it can be extended

The subject access request time limit is set by Article 12(3) GDPR: without undue delay and in any event within one month of receipt. One month is a calendar month, not 30 days. The EDPB applies the EU rules on time periods (Regulation 1182/71), which give the following results:

Situation	Deadline	Source
Standard request received on 5 March	5 April at the latest	Art. 12(3); EDPB para. 160
Request received on 31 August (no 31 September)	30 September, the last day of the following month	EDPB para. 160
Last day falls on a weekend or public holiday	The next working day	EDPB para. 161
Complex request, or several requests from the same person	Up to two further months (three in total), if you tell the person within the first month and give reasons	Art. 12(3); EDPB para. 162
You have reasonable doubts about identity and ask for more information	The clock can be suspended until you receive it, provided you asked without undue delay	Art. 12(6); EDPB para. 159
You process a large quantity of data and ask the person to specify the request	The clock can be suspended in the same way	Recital 63; EDPB para. 159
You decide not to act on the request	Tell the person without delay and within one month, with reasons and their right to complain and go to court	Art. 12(4)

The clock starts when the request reaches you through one of your official channels, not when it reaches the privacy team. A request that sits for ten days in a sales inbox has used ten days. That is the most common reason deadlines are missed.

Treat the extension as the exception. The EDPB says it should not be overused, and that a controller which often needs it probably has to improve its general procedures. Article 12(3) ties the extension to the complexity and number of the requests, not to your own workload.

UK note: what changed under the Data (Use and Access) Act 2025

For UK readers, the Data (Use and Access) Act 2025 amended the UK GDPR in two ways that matter here. Section 76 inserted a new Article 12A, in force since 5 February 2026. The one-month period now runs from the latest of three points: receipt of the request, receipt of any identity information you asked for, and payment of any fee you were entitled to charge. Where you reasonably need more information to identify what the request relates to, the time from asking to receiving the answer does not count. The ICO calls this "stopping the clock". Section 78, in force since Royal Assent in June 2025, makes clear that the person is entitled only to what you can provide on the basis of a reasonable and proportionate search. The ICO's guide to subject access was updated on 16 July 2026 to reflect both changes. None of this applies under the EU GDPR. If you answer requests in both regimes, use the stricter EU starting point.

What you must provide in a DSAR response

A complete answer has two parts: a copy of the personal data, and the supplementary information listed in Article 15(1) and (2).

1. A copy of the personal data

Article 15(3) requires you to provide a copy of the personal data undergoing processing. The EDPB reads "copy" broadly: the copy must be complete and something the person can keep and come back to. It does not always mean copies of the original documents. But in Case C-307/22 (26 October 2023) the Court of Justice held that the person must receive a faithful and intelligible reproduction of all the data. That includes copies of whole documents where this is essential for checking that the data is accurate and complete, or for understanding it.

The guidelines add some practical consequences.

Unless the person says otherwise, the request covers all their personal data, not just what sits in your CRM.
The answer should reflect the data as it stood when you received the request. Data that is incorrect, or that you should not have had, must still be provided.
Data held by your processors on your behalf is in scope, so the search must reach them too.
If the request arrived electronically, answer in a commonly used electronic format unless the person asks for something else.
If you hold no data about the person, say so. That confirmation is the answer.

2. The supplementary information

Alongside the copy, Article 15 requires you to tell the person the following.

the purposes of the processing
the categories of personal data concerned
the recipients or categories of recipient, in particular recipients in third countries
how long the data will be stored, or the criteria used to decide that
that they can ask for rectification or erasure, restriction of processing, or object to the processing
that they can lodge a complaint with a supervisory authority
where the data came from, if you did not collect it from them
whether automated decision-making, including profiling, takes place, and if so meaningful information about the logic involved and its consequences
the safeguards under Article 46 if data is transferred outside the EU/EEA

On recipients, the EDPB expects you to name the actual recipients, unless that is impossible or the request is manifestly unfounded or excessive. If you can only give categories, make them specific: type of recipient, sector and location. Most of this information should already be in your privacy notice and your record of processing activities. The difference is that a DSAR answer must be specific to the requester, not generic.

Where there is a lot of data, a layered response can help: a short overview first, then the detail. The EDPB accepts this when it genuinely helps the person, and every layer must be available at the same time if they want it.

How to handle a DSAR, step by step

The GDPR sets the outcome, not the procedure. The process below is the one we see work in practice. Each step maps to a rule in Article 12 or 15.

Recognise and log the request. Train front-line staff to spot a request in any form and pass it on the same day. Record the date of receipt, because that is day one.
Acknowledge it and set the deadline. Confirm receipt, state the date by which you will respond and name a contact person. Put the deadline and an internal review date in your tracker.
Verify identity proportionately. Only ask for more information if you have reasonable doubts (Article 12(6)). If the person is logged in to their account, that is normally enough. The EDPB considers a copy of an ID card generally not appropriate, and disproportionate where the person is already authenticated. For requests made on someone else's behalf, check the authority as well.
Clarify the scope if you need to. If you hold a large amount of data about the person, you can ask them to specify which information or processing activities they are interested in (Recital 63). If they do not narrow it down, the request still covers all their data.
Search every place the data lives. Use your record of processing activities as the map: core systems, CRM, HR, email, shared drives, chat, backups where relevant, paper files and your processors. Log what you searched and how.
Review, redact and apply exemptions. Remove other people's personal data and anything protected by the rights and freedoms of others, such as trade secrets (Article 15(4)). Redact the parts that would cause harm. Do not withhold whole documents. Check whether national law provides any restrictions that apply in your sector.
Compile the response. Combine the copy of the data with the Article 15 information in a cover letter, in clear and plain language.
Send it securely and keep a record. Use a secure channel, such as encrypted email or a portal. Sending data to the wrong person is a personal data breach. Keep the request, your correspondence, the search log, the redaction decisions and proof of delivery, so you can show compliance under the accountability principle in Article 5(2).

In a group of companies, decide early which entity is the controller for the data in question. Where several entities process the requester's data, coordinate the search across the group so the person gets one coherent answer within one deadline.

Can you refuse a DSAR or charge a fee?

The starting point is that a DSAR is free and must be answered. Article 12(5) allows two exceptions, and you carry the burden of proving that they apply.

Fees

The first copy is always free. The Court of Justice confirmed in C-307/22 that this holds even where the person wants the data for a purpose other than checking that the processing is lawful, for example to bring a claim against you. For further copies you may charge a reasonable fee based on administrative costs (Article 15(3)). According to the EDPB, that fee must reflect the cost of the extra copy and must not include overheads. You may also charge a reasonable fee instead of refusing when a request is manifestly unfounded or excessive.

Manifestly unfounded or excessive requests

Where a request is manifestly unfounded or excessive, in particular because it is repetitive, you may refuse to act on it or charge a reasonable fee. Both terms are narrow:

Manifestly unfounded means the requirements of Article 15 are clearly and obviously not met on an objective view.
Excessive is mainly about repetition, such as the same person asking again and again with nothing having changed.

The EDPB lists what does not make a request excessive: the person gives no reason, you think the request is pointless, the language is rude, or the person intends to use the data in a claim against you. Nor can a request be excessive solely because answering it takes a lot of time and effort.

Other people's data

Article 15(4) protects the rights and freedoms of others, including trade secrets and intellectual property. It allows you to leave out or redact the affected parts. It does not allow you to refuse the whole request.

If you refuse, in full or in part, Article 12(4) requires you to tell the person within one month, give your reasons and inform them that they can complain to a supervisory authority and seek a judicial remedy.

Common DSAR mistakes

Starting the clock late. The deadline runs from when any official channel received the request.
Demanding a passport by default. Disproportionate ID checks delay the answer and create new risks, because now you hold a copy of a passport.
Sending only a data export. Without the Article 15 information the response is incomplete.
Listing "partners" as recipients. Name the recipients, or at least give specific categories.
Forgetting processors, email and chat. These are where most of the missed data turns up.
Over-redacting or under-redacting. Withholding whole documents breaches Article 15, and leaving third-party data in is a breach of confidentiality.
Using the extension routinely. It is meant for genuinely complex cases and you must give reasons within the first month.
Keeping no record. If a complaint reaches the supervisory authority, your log is your evidence.

DSAR response checklist and template

Copy the checklist below into your procedure. It follows the order of the steps above.

Checkpoint	Done when
Request logged	Date of receipt, channel, requester and type of request recorded
Deadline set	One-month deadline and an internal review date in the tracker
Acknowledgement sent	Requester knows the expected response date and a contact person
Identity and authority confirmed	Proportionate check documented, or reasons why none was needed
Scope agreed	All data, or the specific information the requester asked for
Search completed	Every system in the record of processing activities checked, processors included, search log saved
Review and redaction done	Third-party data and protected information removed, reasons recorded
Extension decided	Either not needed, or the requester told within one month with reasons
Response sent	Copy plus Article 15 information delivered securely, before the deadline
File closed	Correspondence, decisions and proof of delivery stored

A response letter can follow this structure:

Reference to the request and the date you received it
Confirmation that you process personal data about the person (or that you do not)
What is enclosed and in which format
The purposes, categories of data, recipients, storage period and source
Information on automated decision-making and on transfers outside the EU/EEA, where relevant
Any information withheld or redacted, and why
The person's rights to rectification, erasure, restriction and objection, and their right to complain to the supervisory authority
A contact point for questions

Organisations in Denmark can also use the Danish Data Protection Agency's templates (in Danish) for the information part of the answer.

What happens if you get it wrong?

Infringements of the data subject rights in Articles 12 to 22 fall in the higher fine bracket of Article 83(5)(b): up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. The right of access is also where two of the seven GDPR principles become concrete for one person: transparency, and accountability, which means you must be able to show that you answered properly. A weak DSAR process is usually a sign of wider gaps.

How .legal helps with access requests

In .legal's GDPR module you can log each request, track the deadline and keep the correspondence and decisions in one place. Your record of processing activities then shows which systems, processors and retention rules apply when you search. Book a demo to see how it works.

Frequently asked questions about data subject access requests (DSARs)

What does DSAR stand for?

DSAR stands for data subject access request. It is a request from an individual to an organisation for confirmation of whether their personal data is processed, a copy of that data and information about how it is used. The right comes from Article 15 GDPR.

What is the time limit for responding to a subject access request?

You must respond without undue delay and at the latest within one month of receiving the request. A request received on 5 March must be answered by 5 April. If the request is complex or the person has made several, you can extend by two further months, but you must tell them within the first month and explain why.

Is a SAR the same as a DSAR?

Yes. SAR (subject access request) is the term the UK regulator, the ICO, mostly uses, while DSAR is common elsewhere. Both refer to the right of access in Article 15 of the GDPR or the UK GDPR.

Can you charge a fee for a DSAR?

Not for the first copy, which is always free, even if the person wants the data to bring a claim against you. You may charge a reasonable fee based on administrative costs for further copies, or where a request is manifestly unfounded or excessive. The fee must reflect the actual cost and must not include overheads.

Can you refuse a subject access request?

Only if the request is manifestly unfounded or excessive, typically because it is repetitive, and you must be able to prove it. A request is not excessive just because it takes a lot of work, gives no reason or is meant to support a claim against you. If you refuse, you must tell the person within one month, give your reasons and inform them of their right to complain and go to court.

Do we have to verify the requester's identity, and can we ask for a passport?

You may ask for more information if you have reasonable doubts about who is asking. The check must be proportionate. If the person is logged in to their account that is normally enough, and the EDPB considers a copy of an ID card generally not appropriate. Under the EU GDPR the clock can be suspended while you wait for the information, provided you asked without undue delay.

Does a DSAR cover emails and documents that mention the person?

Yes, to the extent they contain the person's personal data. You must provide a copy of that data, and the Court of Justice has held that this includes copies of documents where they are needed to understand the data or check its accuracy. Other people's personal data must be redacted, but you cannot withhold whole documents for that reason.

What should a DSAR response include?

A copy of the personal data plus the information in Article 15: purposes, categories of data, recipients, storage period, the source of the data, the person's other rights, the right to complain to a supervisory authority, any automated decision-making and the safeguards for transfers outside the EU/EEA. The EDPB expects named recipients rather than vague categories wherever possible.

Still unsure?

Ask Johannes directly, he runs most demos personally

Book him here

.legal compliance platform

Handle access requests efficiently and compliantly

Use .legal to manage Data Subject Access Requests, document your processes, and ensure compliance with Article 15 across your organisation – including group companies.

DSAR workflow management
Documentation and audit trail
Group company coordination
Complete GDPR compliance overview

+400 companies use .legal