What is a DSAR?
Published 14 min read
A DSAR is any message in which a person asks what you hold on them. It needs no form and no magic words, and the clock starts the day it reaches you.
A DSAR in 7 lines
- The GDPR's name for it
- Right of access, Art. 15
- California's name for it
- Request to know, Civ. Code § 1798.110
- GDPR deadline
- One month of receipt; two further months where necessary, notified within the first month
- California deadlines
- Confirm within 10 business days; answer within 45 calendar days; 90 calendar days maximum
- What it costs the person
- Free as a rule. GDPR: a reasonable fee only for further copies or a manifestly unfounded or excessive request. California: free of charge
- What goes back
- Confirmation, the data, and the information about its use
- Records to keep
- California: requests and answers for at least 24 months
What a DSAR is, in the laws' own words
A DSAR, a data subject access request, is a person asking an organisation what personal data it holds about them and what it does with it. “DSAR” is the trade’s word, not the law’s. The GDPR calls it the right of access, in Article 15. California’s CCPA calls it a request to know, in Civil Code § 1798.110. The US state privacy laws that followed give a similar right, each with its own clock.
“The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information”
Read slowly, that sentence holds three duties, and the European Data Protection Board’s guidelines on the right of access split them the same way. You confirm whether you process the person’s data at all. If you do, you give them the data itself. And you give them the information about the processing: why, what kinds, who received it, how long you keep it, and where it came from. A reply that sends a data export but none of the information has done one duty of three.
In practice teams use “DSAR” loosely for every rights request: access, deletion, correction, objection. That is a sensible way to run one queue, because under the GDPR one clock covers Articles 15 to 22. But the answers differ. This page is about the access request, the one where you have to send something back.
Spotting one in the inbox
The GDPR sets no form for a request. The EDPB says it is enough for someone to say they want to know what personal data you process about them, and you cannot refuse because they did not cite the right or the law. So the first skill is recognising one. Decide on each message below, then open the answer.
1. From a customer, via the contact form
“Hi, could you tell me what information you have about me? Thanks.”
2. From a long-standing client, via their account manager’s email
“Before we renew, please send me everything your firm holds on me.”
3. From a former employee, via email to HR
“I would like a copy of all the personal data you hold on me. I am considering a claim about my dismissal.”
4. From a California visitor, via your privacy choices link
“Do not sell or share my personal information.”
5. From a former subscriber, via a reply to your newsletter
“Please delete my account and everything attached to it.”
Answers from EDPB Guidelines 01/2022 (paras 50, 54–55, Example 1), GDPR Arts 12(3) and 17, and the CCPA regulations § 7026; read 22 Oct 2026.
Tell everyone who answers customer mail what a request looks like and where to forward it the same day. California already requires a business to make sure the people who handle privacy inquiries know the rules and how to point consumers to their rights (Civ. Code § 1798.130(a)(6)).
What you send back under the GDPR
Article 15 lists the contents. The EDPB says the information part can be built from what you already have, your data map and record of processing and your privacy notice, but it may need updating or tailoring to what you actually do with this one person’s data.
| What goes in the reply | Article | Usually from |
|---|---|---|
| Confirmation that you process their data (or that you do not) | Art. 15(1) | A search of every system |
| A copy of the personal data itself | Art. 15(1), 15(3) | The systems: CRM, mailbox, billing, support desk, paper files |
| The purposes of the processing | Art. 15(1)(a) | Your record of processing, narrowed to this person |
| The categories of personal data | Art. 15(1)(b) | Record of processing |
| The recipients, especially any outside the EU | Art. 15(1)(c) | Processor list and contracts |
| How long the data will be kept, or the criteria | Art. 15(1)(d) | Retention schedule |
| Their rights to rectify, erase, restrict and object | Art. 15(1)(e) | Privacy notice |
| The right to complain to a supervisory authority | Art. 15(1)(f) | Privacy notice |
| Where the data came from, if not from them | Art. 15(1)(g) | Record of processing, lead sources |
| Any automated decision-making or profiling, with the logic | Art. 15(1)(h) | Product and marketing owners |
| The safeguards for transfers outside the EU | Art. 15(2) | Transfer clauses with each processor |
GDPR Art. 15 and EDPB Guidelines 01/2022 (v2.1); read 22 Oct 2026. | ||
The copy
The first copy is free. For further copies you may charge a reasonable fee based on administrative costs. If the person asked by email or a web form, the copy goes back in a commonly used electronic form unless they ask otherwise. The EDPB adds that it should be in a permanent form the person can download, and that codes or raw data may need explaining so they make sense.
Which data, as of when
Unless the person narrows it, a request covers all of their data. You search every IT system and paper filing system by the identifiers you file people under, such as name and customer number. The answer reflects the data as it stood when the request arrived, including data that is wrong or that you should not have. Data you already deleted under your retention policy cannot be given. Data on a very short retention clock needs a hold, so it is not erased while the request is being dealt with.
Keep a reply skeleton with all 11 rows above, filled from your records, so each request only needs the person’s own data added. The DSAR response template is built on that idea.
What you can hold back, and what you cannot
The GDPR has a short list of limits on the right of access, and the EDPB reads every one narrowly. These are the ones a small firm meets.
You may
- Black out other people’s data, or trade secrets, in the copy, where you can show the harm in this case (Art. 15(4), Recital 63).
- Ask the person to say which information or processing they mean, when you process a large quantity of data about them (Recital 63).
- Charge a reasonable fee for further copies (Art. 15(3)), or for a request that is manifestly unfounded or excessive (Art. 12(5)).
- Refuse a manifestly unfounded or excessive request, if you can prove it is one (Art. 12(5)).
You may not
- Refuse the whole request because the copy contains other people’s data. You redact; you do not withhold.
- Hold back the information about the processing, Art. 15(1)(a) to (h), on the ground of others’ rights. Art. 15(4) does not reach it.
- Refuse because answering takes a lot of work. The EDPB reads no general proportionality limit into the right.
- Ask why the person wants it, or deny access because they might use the data in a dismissal or commercial dispute with you (EDPB para 13).
“However, the result of those considerations should not be a refusal to provide all information to the data subject.”
“Excessive” depends on your sector. The EDPB’s test is how often the data changes: the more often your records about a person change, the more often they may ask without it being excessive. Member State law can add restrictions under Article 23, so check your own country’s act before relying on one.
Say so, with your reasons, without delay and at the latest within one month of receipt, and tell the person they can complain to a supervisory authority and go to court (Art. 12(4)). Silence is the one answer the law never allows. Breaches of the data subject rights, Articles 12 to 22, sit in the GDPR’s upper fine tier: up to EUR 20 000 000 or up to 4 % of total worldwide annual turnover of the preceding financial year, whichever is higher.
Checking it is really them
Sending someone’s data to the wrong person is an unauthorised disclosure, a personal data breach under Article 4(12), so every process checks identity. The two regimes set the bar in opposite places. The GDPR starts from trust and lets you ask for more only with a reason. California makes verification the default and grades it by what is being disclosed.
| Question | GDPR (EDPB guidance) | California (CCPA and regulations) |
|---|---|---|
| When you may ask for proof | Only when you have reasonable doubts about who is asking (Art. 12(6)), and in proportion to the data and the harm a wrong disclosure could do | Before disclosing anything. The level depends on what is asked for (§ 7062) |
| A customer with an account | Their login is normally enough. Asking an already authenticated person for an ID copy is disproportionate (EDPB para 73) | You may ask them to use their account, but you cannot make anyone open one to ask (§ 1798.130(a)(2)(A)) |
| Someone without an account | Use what you already have: a confirmation link by email or text, a security question or code. ID copies are generally not appropriate (paras 74–75) | Categories: match two data points you hold. Specific pieces: match three, plus a declaration signed under penalty of perjury (§ 7062(b)–(c)) |
| The clock while you wait | Can pause while you wait for the identity details, if you asked for them without undue delay (EDPB para 159) | Does not pause. The 45 calendar days run from the day you receive the request, however long verification takes (§ 7021(b)) |
| If you cannot identify them | Tell the person; you may refuse access unless they give details that let you identify them (Art. 12(2), EDPB) | Give no specific pieces. Treat it as a request for categories, or point them to your privacy policy (§ 7024(a)–(b)) |
GDPR Art. 12(6), EDPB Guidelines 01/2022 (v2.1), Civ. Code § 1798.130, CCPA regulations §§ 7021, 7024, 7062; read 22 Oct 2026. | ||
Requests made for someone else
In California a consumer can use an authorized agent. You may ask the agent for the consumer’s signed permission and ask the consumer to verify themselves or confirm the permission directly, but you cannot demand a power of attorney (§ 7063). Whatever you collect to verify someone is for verification only: you may not keep it longer than needed or use it for anything else (§ 1798.130(a)(7)).
Write down your identity rule before the first request arrives: which details you match, for which kind of request, and who decides when something looks wrong. A rule made up under deadline pressure is how ID copies end up stored in a shared inbox.
The California version: a request to know
Under the CCPA a consumer can ask for two things, and a request often asks for both. The first is the categories: what kinds of personal information you collected, where from, why, and who you disclosed or sold it to. The second is the specific pieces: the data itself. The reply to a request for categories must cover all of these, in an answer written for this consumer:
- the categories of personal information you collected about them;
- the categories of sources it came from;
- the business or commercial purpose for collecting, selling or sharing it;
- the categories of third parties you disclose it to;
- the categories you sold or shared, and to which categories of third parties, category by category;
- the categories you disclosed for a business purpose, and to which service providers or contractors.
Pointing to your privacy policy instead is allowed only when your answer would be the same for every consumer and the policy already says all of it (regs § 7024(j)). For the wider law, see what the CCPA is.
How far back, and what never goes in
The answer covers the 12 months before you received the request. The consumer can ask for more, back to data collected on or after 1 January 2022, and you must give it unless that is impossible or would take disproportionate effort; if you claim that, you owe a detailed explanation, not a bare statement (§ 7024(h)). Data your service providers and contractors collected for you counts as yours.
Some data is never sent back: Social Security, driver’s licence and other government ID numbers, financial account numbers, health insurance or medical ID numbers, account passwords, security questions and answers, and biometric data. You say that you hold that type of data, without sending it (§ 7024(d)).
Format, cost and how often
The answer is free, in writing, through the consumer’s account if they have one or by mail or electronically as they prefer, in a format they can easily pass on to another business (§ 1798.130(a)(2)(A)). You do not have to answer the same consumer’s requests to know more than twice in 12 months (§ 1798.130(b)). To receive requests you offer two or more methods, including at least a toll-free number; a business that operates exclusively online and has a direct relationship with the consumer need only provide an email address.
If you answer both EU and California requests, build one reply that holds the GDPR rows and the California categories together, and keep the 12-month window in mind for California only. Where the two laws part company more widely is set out in GDPR vs CCPA.
The clocks, side by side
The deadline is the easiest part of a reply to get provably wrong. Each law sets its own, so a request from California and one from Germany that arrive the same morning fall due on different dates. The last column runs a request received on Mon 31 Aug 2026 through the DSAR deadline calculator’s own code.
| Law and request | Confirm receipt | Answer within | Extension | Example: answer due |
|---|---|---|---|---|
| GDPR, any rights request | none set | one month of receipt | two further months where necessary | Wed 30 Sep 2026 |
| California, request to know, delete or correct | 10 business days | 45 calendar days | 45 more, 90 calendar days in all | Thu 15 Oct 2026 |
| California, opt-out of sale or sharing | none set | 15 business days | none | Mon 21 Sep 2026 |
| Virginia and 12 other state laws in the calculator | none set | 45 days | 45 more days | Thu 15 Oct 2026 |
| Iowa | none set | 90 days | 45 more days | Sun 29 Nov 2026 |
GDPR Art. 12(3), CCPA regulations §§ 7021 and 7026, Va. Code § 59.1-577, Iowa Code § 715D.3; dates by the DSAR deadline calculator; read 22 Oct 2026. | ||||
Under the GDPR and in California an extension only counts if you tell the person inside the first period, with the reasons. Diary that date as well as the answer date. Under the GDPR the extension is for complex requests or many of them; the EDPB says a firm that often needs one should fix its process instead.
Weekends, public holidays and whether the day of arrival counts are where teams lose a day. The calculator page sets out how it counts each one. Which of these laws reach you at all is a separate question: the which privacy laws apply checker answers it first.
From inbox to reply, step by step
A firm that gets a handful of requests a year can run every one by hand if the steps are written down. These are the stops, in order, with the rule behind each.
- 01
Log it the day it arrives
Date received, channel, who it is from, what they ask for. Every clock starts here.
Regs § 7101(a): keep request records at least 24 months
- 02
Confirm receipt
Say you have it, how it will be handled and when to expect the answer.
California: within 10 business days (§ 7021(a))
- 03
Check identity, at once
Apply your written rule. Ask for anything extra straight away: a GDPR pause only counts if you asked without undue delay.
GDPR Art. 12(6); EDPB para 159; regs § 7062
- 04
Diary both dates
The answer date, and the last day to announce an extension.
GDPR Art. 12(3); regs § 7021(b)
- 05
Search every system, and ask your vendors
Mailboxes, CRM, billing, support desk, paper files. Processors and service providers must help you answer.
GDPR Art. 28(3)(e); regs § 7024(i)
- 06
Review and redact
Black out other people's data. For California, strip government ID, account and medical numbers, passwords and biometrics.
GDPR Art. 15(4); regs § 7024(d)
- 07
Assemble and send it securely
The data plus the information rows, in a commonly used electronic form if they asked electronically.
GDPR Art. 15(3); regs § 7024(f)
- 08
Close the record
What you sent, when, and any part you withheld with the reason.
Regs § 7101(a)
Once requests come every month, or your data sits in more systems than one person can search in a week, a dedicated tool starts to pay. Our DSAR software comparison sorts the options by how much of these 8 steps each one takes off you.
Questions
Does a DSAR have to use our form or our privacy email address?
Not under the GDPR. You can offer a preferred channel, but the EDPB says a request sent through another channel you provide is in general still effective and should be handled. Only mail to random or wrong addresses, or to staff with nothing to do with requests, can be set aside, and only if you publish a proper channel.
What if we hold no data about the person?
You still answer. The right starts with confirmation of whether or not you process their data (Art. 15(1)), so “we hold nothing about you” is itself the reply, sent within the same deadline.
Can we charge for answering?
Under the GDPR the answer is free; you may charge a reasonable fee based on administrative costs for further copies, or for a request that is manifestly unfounded or excessive. In California the information is delivered free of charge.
How often can the same person ask?
The GDPR says at reasonable intervals (Recital 63), and the EDPB ties that to how often your data about the person changes. In California you need not answer the same consumer’s requests to know more than twice in 12 months (§ 1798.130(b)).
A request reached our software vendor instead of us. Whose job is it?
Yours. A processor helps the controller answer (GDPR Art. 28(3)(e)). In California a service provider or contractor need not answer a request sent to it directly about data it holds for you, but it must help you answer, including by handing over the data (§ 1798.130(a)(3)(A)). Make sure your contracts say how fast; the data processing agreement template has a clause for that help.